SecurityHealthDashboard

WPF-based operator dashboard. Enter a target computer name; the tool connects over
PowerShell Remoting (WinRM) and collects a holistic snapshot of native Microsoft
security tooling and identity state:

 - Microsoft Defender AV: engine/platform/signature versions, last signature sync,
   real-time protection, tamper protection, cloud (MAPS) settings, scan history,
   exclusions, ASR rules (block/audit/warn), threat detections
 - Defender operational events: detections, remediations, ASR / Controlled Folder
   Access / Network Protection blocks and audits, config changes, service state changes
 - Windows Firewall: profile state, default actions, rule counts, rule add/change/delete
   events, blocked connections (Filtering Platform audit events 5152/5157)
 - AppLocker: effective policy enforcement per rule collection + allowed/audited/blocked events
 - WDAC / Device Guard: VBS, HVCI, Credential Guard, Code Integrity enforcement + 3076/3077 events
 - Defender for Endpoint (Sense) onboarding state and last-connected time
 - SmartScreen app reputation: the "Windows protected your PC" prompts, from the
   Microsoft-Windows-SmartScreen/Debug analytic channel. That channel is DISABLED
   BY DEFAULT on Windows; the tool reports whether it is on, so an empty result
   reads as "not logged" rather than "nothing was blocked"
 - Smart App Control state (its blocks surface as Code Integrity 3077/3076)
 - BitLocker, Secure Boot, TPM, LSA protection (RunAsPPL), SmartScreen policy, UAC
 - Identity: domain / Entra (Azure AD) join state via dsregcmd, secure channel health,
   local admins, local users, active sessions, logon summary, failed logons,
   account/group-change and audit-policy-change events, log-cleared events
 - Policy: applied GPOs (gpresult), last GP refresh, MDM (Intune) enrollment,
   effective audit policy (auditpol)
 - Security-relevant services and recent hotfixes

Results render as a tabbed dashboard with health cards, derived "attention items",
and a unified Blocked / Audited / Allowed event view.

"Export HTML report" writes a single self-contained .html file that mirrors this
dashboard: the same tabs, the same health cards, the same attention items, and
tables with click-to-sort headers, per-column filter dropdowns, a global find box
with per-tab match counts, the Events quick filters, click-a-row detail, and a
per-table CSV download of whatever is currently filtered. It has no external
dependencies, so it works from a file share, an email attachment or a ticket, and
Print / PDF expands every tab for archiving. The dashboard and the report are
generated from the same New-HealthCards / Get-UnifiedEvents functions, so the two
views cannot drift apart.

FLEET
Give it several targets and they are scanned in parallel through a throttled
runspace pool. The Fleet tab lists one row per host with a Deviation count -
how many posture fields differ from the fleet norm - so sorting by it floats
the odd machines to the top. Pick any host to load its full detail.

BASELINE AND DIFF
"Save baseline" writes the whole scan as a normalised JSON snapshot;
"Compare to..." loads one back and the Changes tab shows every difference,
with security-relevant regressions (real-time protection switched off, a new
exclusion, a new local admin, script block logging disabled) flagged and
sorted first. Event volumes are compared by count, since individual events
are time-windowed and would drown the diff in noise.