55 modules. 7 categories.

Windows 14

• DISM RestoreHealth

  Action Remote Asks to confirm

  After explicit confirmation, runs DISM /Online /Cleanup-Image /RestoreHealth on the selected target and verifies component-store health.

  windows.dism-restore-health · PowerShell

• Force Group Policy Refresh

  Action Local only Asks to confirm

  After explicit confirmation, runs a bounded gpupdate /force operation and reports its exit status without automatically rebooting or logging off the user.

  windows.group-policy-refresh · PowerShell

• Repair Windows Installer Service

  Action Remote Asks to confirm

  After confirmation, restores the Windows Installer service to demand start, starts it when possible, and optionally refreshes msiexec registration.

  windows.installer-repair · PowerShell

• Repair Windows Update Services and Cache

  Action Remote Asks to confirm

  After confirmation, normalizes core Windows Update service startup, optionally renames the SoftwareDistribution and catroot2 caches for rollback, restarts services, and validates recovery.

  windows.update-repair · PowerShell

• Windows Startup and Logon Trace Management

  Action Remote Asks to confirm

  Installs, inspects, or removes a bounded all-users At Log On trace that records shell timing, startup processes, Group Policy, profile events, mapped resources, and GPResult evidence under C:\TEMP.

  windows.logon-trace-management · PowerShell

• Group Policy Health

  Diagnostic Remote

  Assesses domain membership, domain-controller discovery, secure channel, SYSVOL and NETLOGON reachability, Group Policy dependencies, policy caches, pending reboot, time synchronization, AVD posture, and recent policy-related events without changing the device.

  windows.group-policy-health · PowerShell

• Protected System File Verification (SFC)

  Diagnostic Local only

  Runs SFC /verifyonly to verify protected Windows system files without replacing or repairing files.

  windows.system-file-verification · PowerShell

• Windows Disk and File-System Health

  Diagnostic Local only

  Runs an online CHKDSK /scan against the Windows system volume and collects disk reliability, dirty-bit, capacity, and recent storage-event indicators.

  windows.disk-file-system-health · PowerShell

• Windows Image Health (DISM)

  Diagnostic Local only

  Runs the non-repairing DISM CheckHealth, ScanHealth, and AnalyzeComponentStore operations against the online Windows image.

  windows.image-health · PowerShell

• Windows Installer Diagnostics

  Diagnostic Remote

  Checks Windows Installer service configuration, executable registration, policy, in-progress installer state, reboot indicators, and recent MsiInstaller events without making changes.

  windows.installer-health · PowerShell

• Windows Servicing Readiness

  Diagnostic Local only

  Performs a fast, non-destructive assessment of pending reboot indicators, servicing dependencies, CBS/DISM log metadata, recent servicing events, Windows Update policy pause state, and system-volume headroom before longer DISM or SFC checks.

  windows.servicing-readiness · PowerShell

• Windows Update Diagnostics

  Diagnostic Remote

  Checks Windows Update services, policy, reboot state, cache metadata, update history, and recent update-client errors without scanning for or installing updates.

  windows.update-health · PowerShell

• Windows Startup and Logon Trace Collection

  Log collector Remote

  Collects Windows logon timing traces and provides local findings for slow shell arrival, missing startup components, warning/error events, and high-impact startup processes.

  logs.startup-logon · PowerShell

• Windows System Log Collection

  Log collector Remote

  Collects recent Windows servicing, setup, update, and System event logs into a bounded support archive.

  logs.windows-system · PowerShell

System 11

• Restart Device

  Action Remote Asks to confirm

  Schedules a Windows restart on the selected local or remote target.

  windows.restart-device · PowerShell

• Shut Down Device

  Action Remote Asks to confirm

  After explicit confirmation, schedules a Windows shutdown on the selected local or remote target.

  windows.shutdown-device · PowerShell

• BSOD Collection and Basic Analysis

  Analyzer Remote Asks to confirm

  Reviews recent Windows bugcheck events and minidump metadata, maps common stop codes to first-response guidance, and can collect a bounded ZIP of recent minidumps.

  windows.bsod-analysis · PowerShell

• Directory Size Analyzer

  Analyzer Remote

  Builds a bounded directory-size inventory for a selected local or remote path, highlights the largest folders, and exports a CSV.

  storage.directory-size-analysis · PowerShell

• Process Analysis

  Analyzer Remote

  Samples running processes on the selected target, ranks CPU and memory use, and highlights transparent heuristics such as execution from temporary folders or invalid signatures.

  system.process-analysis · PowerShell

• System Health Rules

  Analyzer Remote

  Evaluates externally configured disk, uptime, reboot, CPU, and memory thresholds against health data sampled on the selected target.

  system.health-rules · PowerShell

• Battery, Power and Sleep Health

  Diagnostic Remote

  Assesses installed batteries through the native Windows battery interface, powercfg XML, and Win32_Battery, reporting charge, design/full-charge capacity, cycle count, and estimated capacity health.

  hardware.battery-health · PowerShell

• Computer Summary

  Diagnostic Remote

  Assesses computer identity, CPU sampling, memory pressure, disk capacity, uptime, pending reboot indicators, and IPv4 presence.

  system.computer-summary · PowerShell

• Dell Hardware and Firmware Health

  Diagnostic Remote

  Reports Dell model and service tag, BIOS version and firmware age, Dell Command and SupportAssist management software, and TPM readiness.

  hardware.dell-health · PowerShell

• Device Driver Health

  Diagnostic Remote

  Identifies devices with Plug and Play error codes, unsigned or problem drivers, recent driver-related System events, and devices lacking a usable driver.

  hardware.device-driver-health · PowerShell

• SSD and Physical Disk Health

  Diagnostic Remote

  Collects physical-disk health, operational state, media type, temperature, wear, read/write error counters, and storage reliability telemetry without running a stress test or making changes.

  storage.ssd-health · PowerShell

Identity & Security 10

• Manage Local Administrator Membership

  Action Remote Asks to confirm

  After critical confirmation, adds or removes one explicit account from the selected target's built-in local Administrators group.

  identity.local-administrator-membership · PowerShell

• Move Computer to Active Directory OU

  Action Remote Asks to confirm

  After confirmation, uses local RSAT and signed-in directory permissions to move the selected computer object only to the configured approved OU root or one of its descendants.

  identity.active-directory-computer-ou-move · PowerShell

• Remove User Profiles

  Action Remote Asks to confirm

  Removes unused Windows user profiles from the selected computer.

  identity.user-profile-removal · PowerShell

• BitLocker Encryption and Recovery Key Health

  Diagnostic Remote

  Reports BitLocker protection, encryption progress, cipher, and key protectors for every fixed volume, plus the recovery-key directory backup policy in effect.

  security.bitlocker-health · PowerShell

• CrowdStrike Sensor Health

  Diagnostic Remote

  Performs a safe read-only assessment of CrowdStrike sensor installation, service, process, driver, signature, identifier presence, and recent service errors.

  security.crowdstrike-health · PowerShell

• GlobalProtect Health

  Diagnostic Remote

  Assesses GlobalProtect installation, PanGPS service, client processes, virtual adapters, configuration presence, VPN client certificate validity, summarized log errors, and recent service events.

  vpn.globalprotect-health · PowerShell

• Hybrid Join, PRT and Kerberos Health

  Diagnostic Remote

  Cross-checks the computer's Entra registration artifacts against each other to find registration desync, and reports Primary Refresh Token state, Kerberos tickets and the error codes from the last registration and token attempts. Read-only.

  identity.hybrid-join-sso-health · PowerShell

• Machine Certificate Health

  Diagnostic Remote

  Reports the machine personal certificate store, client-authentication certificates used for 802.1X and VPN, approaching and passed expiry, whether each issuer is present in the local intermediate and root stores, and autoenrollment configuration and recent enrollment failures.

  security.certificate-health · PowerShell

• CrowdStrike Log Collection

  Log collector Remote

  Collects recent locally available CrowdStrike logs and focused CrowdStrike application events.

  logs.crowdstrike · PowerShell

• GlobalProtect Log Collection

  Log collector Remote

  Collects recent GlobalProtect PanGPS and PanGPA logs plus focused application events.

  logs.globalprotect · PowerShell

Networking 8

• Flush DNS Cache

  Action Remote Asks to confirm

  Performs DNS service and resolution preflight checks, clears the Windows resolver cache after confirmation, and validates post-action resolution.

  network.dns.flush · PowerShell

• Repair DNS Cache and Registration

  Action Remote Asks to confirm

  After explicit confirmation, clears the target resolver cache and/or requests dynamic DNS registration.

  network.dns-registration-repair · PowerShell

• DNS Registration and Mismatch Check

  Diagnostic Remote

  Compares the target's active IPv4 addresses with forward and reverse DNS, checks per-adapter registration settings, tests configured DNS servers, and identifies obvious stale or missing registrations without making changes.

  network.dns-consistency · PowerShell

• HOSTS File Diagnostics

  Diagnostic Remote

  Safely parses the Windows HOSTS file and reports active overrides, malformed or duplicate records, conflicting mappings, unusual file metadata, and DNS differences without changing the file.

  network.hosts-file-diagnostics · PowerShell

• IP Configuration

  Diagnostic Remote

  Assesses adapters, IP addressing, APIPA, routes, gateways, DNS, profiles, and WinHTTP proxy state using Windows PowerShell.

  network.ip-configuration · PowerShell

• VPN and Proxy Detection

  Diagnostic Remote

  Detects system and WinHTTP proxy settings, PAC file configuration, VPN adapters and RAS VPN connections without making changes.

  network.vpn-proxy-detection · PowerShell

• Wireless Network Health

  Diagnostic Remote

  Reports the wireless adapter and driver, radio and association state, signal quality, band and cipher, configured profiles, adapter power management, and recent WLAN connection and authentication failures.

  network.wireless-health · PowerShell

• Network Log Collection

  Log collector Remote

  Collects recent Windows network tracing artifacts and focused WLAN, NCSI, and DNS Client event logs.

  logs.networking · PowerShell

Endpoint Management 5

• Trigger Configuration Manager Client Actions

  Action Remote Asks to confirm

  After explicit confirmation, triggers a selected set of Microsoft Configuration Manager client schedules on the local or remote target.

  endpoint.configuration-manager-client-actions · PowerShell

• Intune and SCCM Co-management Diagnostics

  Diagnostic Remote

  Correlates Configuration Manager client health, co-management workload state, MDM enrollment artifacts, Entra join status, certificates, scheduled tasks, and recent management events.

  endpoint.comanagement-health · PowerShell

• Virtual Desktop and FSLogix Health

  Diagnostic Remote

  Checks Azure Virtual Desktop and Windows 365 session host registration, agent services, FSLogix profile container configuration, and temporary-profile signals that indicate a failed container attach.

  endpoint.avd-session-host-health · PowerShell

• ServiceNow Asset Intelligence

  Integration Remote

  Retrieves the selected local or remote computer's ServiceNow CMDB asset, assignment, lifecycle, location, model, and assigned-user device footprint without requiring Configuration Manager collection scope or remote Windows access.

  integration.servicenow-asset-intelligence · Python

• Endpoint Management Log Collection

  Log collector Remote

  Collects recent Configuration Manager and Intune Management Extension logs plus device-management events.

  logs.endpoint-management · PowerShell

Software 4

• Managed Application Uninstall

  Action Remote Asks to confirm

  Presents an UninstallView-style live inventory with product-code GUIDs.

  software.managed-application-uninstall · PowerShell

• Chrome and Chrome Management Troubleshooting

  Diagnostic Remote

  Assesses Chrome installation, enterprise policy sources, enrollment indicators, updater components, profile state, and management endpoint reachability without exposing enrollment tokens.

  browser.chrome-management-health · PowerShell

• Microsoft 365 Apps and Outlook Health

  Diagnostic Remote

  Reports the Click-to-Run build, update channel and servicing age, Office activation state, and the interactive user's Outlook profiles, data-file sizes, and add-in state.

  software.m365-apps-health · PowerShell

• Chrome Log Collection

  Log collector Local only Asks to confirm

  Launches an isolated, confirmed Chrome diagnostic session with verbose logging and bounded NetLog capture, automatically visits controlled Google and Chrome Enterprise test destinations, then collects the session and recent Chrome logs.

  logs.chrome · Python

Printing 3

• Clear Print Spooler Queue

  Action Remote Asks to confirm

  After explicit confirmation, stops the Print Spooler, removes pending spool files without disclosing document names or contents, restarts the service, and verifies recovery.

  printing.spooler-reset · PowerShell

• Printer Troubleshooting

  Diagnostic Remote

  Assesses the Print Spooler, installed printers, queues, ports, drivers, and recent PrintService errors without changing printer state.

  printing.troubleshoot · PowerShell

• Printing Log Collection

  Log collector Remote

  Collects recent printer driver logs and Windows PrintService event logs without collecting spool job content.

  logs.printing · PowerShell

Troubleshooting packs 11

A pack runs a curated set of modules in one go. Technicians can also build their own.

• Chrome Management Troubleshooting

  1 module

  Runs Chrome installation, policy, enrollment-indicator, updater, profile, and management endpoint checks.

  Runs: Chrome and Chrome Management Troubleshooting

• Diagnostic Analysis

  3 modules

  Runs the read-only storage, process and blue-screen analyzers. Repair and power actions are deliberately left out and must be launched individually.

  Runs: Directory Size Analyzer → Process Analysis → BSOD Collection and Basic Analysis

• Endpoint Agents Health

  2 modules

  Assesses CrowdStrike sensor and GlobalProtect client health without changing either security product.

  Runs: CrowdStrike Sensor Health → GlobalProtect Health

• General System Health

  2 modules

  Collects a computer summary and then evaluates externally configured health thresholds.

  Runs: Computer Summary → System Health Rules

• Group Policy Troubleshooting

  1 module

  Runs the read-only Group Policy domain, dependency, cache, reboot, time, AVD, and event assessment. The separate forced-refresh action is deliberately not run automatically.

  Runs: Group Policy Health

• Hardware Health

  2 modules

  Assesses battery capacity and physical-disk reliability telemetry without running a stress test or changing hardware settings.

  Runs: Battery, Power and Sleep Health → SSD and Physical Disk Health

• Network Reset

  3 modules

  Sequentially flushes the DNS resolver cache, repairs DNS registration, and collects the resulting IP configuration to verify the network stack is clean. Requires elevation.

  Runs: Flush DNS Cache → Repair DNS Cache and Registration → IP Configuration

• Network Troubleshooting

  5 modules

  Collects current adapter, address, gateway, DNS configuration, forward/reverse registration consistency, wireless client state, VPN/proxy detection, and the machine certificate state behind 802.1X authentication without making changes.

  Runs: IP Configuration → DNS Registration and Mismatch Check → Wireless Network Health → VPN and Proxy Detection → Machine Certificate Health

• Printer Troubleshooting

  1 module

  Runs the read-only printer service, queue, job, port, driver, and event assessment.

  Runs: Printer Troubleshooting

• ServiceNow Device Context

  1 module

  Retrieves the selected computer's CMDB asset and assignment context through the configured ServiceNow API.

  Runs: ServiceNow Asset Intelligence

• System Image Health

  3 modules

  Checks the Windows component store with DISM, repairs corruption with RestoreHealth, then verifies protected system files with SFC. Runs locally only and requires elevation. May take 30+ minutes on a damaged image.

  Runs: Windows Image Health (DISM) → DISM RestoreHealth → Protected System File Verification (SFC)