- 
+ 
- 
+ 
- 
+
- 
+
The address may be outdated or incomplete. The project homepage and troubleshooting library are still available.
- -Start from the symptom, run the relevant read-only PowerShell module and use the generated evidence to narrow the next step. The toolkit reports state; it does not automatically repair or reconfigure Windows.
- -Create a local TXT and Markdown support report, redact common identifiers with Privacy Mode and review the result before sharing.
Open the support report guideUse Application Error, Windows Error Reporting, hang, BugCheck and recent dump metadata to confirm repeated failures.
Open the application crash guideCompare available physical memory, pagefile usage and top processes by working set without installing a monitoring agent.
Open the high memory guideInspect installed updates, reboot indicators and Windows Update related services without starting a scan or installing anything.
Open the pending reboot guideList physical disk health and volume free-space percentages with a configurable low-space warning threshold.
Open the disk health guideCheck Domain, Private and Public firewall state together with Defender, Secure Boot, TPM and BitLocker context.
Open the Firewall guideInspect W32Time state, start mode, timezone, clock values, configured source, verbose status and optional events.
Open the time synchronization guideCompare route metrics, gateways, adapters, DNS, DHCP and WinINET or WinHTTP proxy context without changing the network stack.
Open the network route guide-PrivacyMode before attaching a report to a public issue, forum or support request. Always inspect the final file manually.Create a local report of recent application crashes, hangs, system BugCheck events and dump-file metadata without opening dump contents or changing Windows Error Reporting.
- - - - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Crashes -PrivacyMode -ExportMarkdownThe command creates a local TXT report and an optional Markdown report. -PrivacyMode replaces common identifying values in the combined report, but the final file should still be reviewed before it is posted publicly.
Recent Application Error, Windows Error Reporting and Application Hang metadata from the Windows Event Log.
Recent BugCheck events that may indicate a blue-screen or system-level crash rather than an application-only failure.
File name, timestamp, size and source for recent Minidump, MEMORY.DMP and user CrashDumps files.
An aggregated WARN or ERROR item appears before the detailed event list when relevant evidence is found.
Repeated application names, providers, event IDs and similar timestamps are more useful than a single isolated event. A cluster of failures from the same program can support an application-specific or vendor-specific investigation.
-An Application Error or Application Hang event does not mean Windows itself crashed. A BugCheck event or fresh system dump is stronger evidence of a system-level failure and should be investigated separately.
-Match the report timestamps to the time the application closed or froze. Old events may be unrelated to the current problem, especially on systems with a long Event Log history.
-The toolkit lists dump metadata but never opens or analyzes the dump. Debugging a dump requires a separate debugger and suitable symbols.
- -Generate one local TXT and Markdown report for Windows 10 or Windows 11, review the findings summary and share only the redacted evidence relevant to the support request.
- - - - -Open PowerShell in the toolkit directory and run:
-pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -All -PrivacyMode -ExportMarkdownFor Windows PowerShell 5.1:
-powershell.exe -NoProfile -ExecutionPolicy Bypass `
- -File .\Invoke-WindowsDiagnostics.ps1 `
- -All -PrivacyMode -ExportMarkdownThe one-run execution-policy bypass applies only to that PowerShell process. It does not change the machine-wide execution policy.
- -Actionable conditions are grouped as OK, WARN or ERROR before the detailed diagnostic output.
Windows build, hardware summary, uptime, memory, CPU snapshot, pagefile and top processes.
Defender, Firewall, Secure Boot, TPM, BitLocker, installed updates and reboot indicators.
Adapters, DNS, DHCP, routes, proxy state, reachability, W32Time source and synchronization context.
Physical disk health, free space, automatic services not running and optional startup or scheduled-task context.
Recent application failures, hangs, BugCheck events, dump metadata and critical or error events.
Privacy Mode replaces common computer names, user names, profile paths, IP and MAC addresses, SIDs, GUIDs and device identifiers with stable per-report tokens. It is intended to make a support report safer to share, not to guarantee complete anonymity.
-Invoke-WindowsDiagnostics.ps1.A useful report is accompanied by a short description of the symptom. Include:
-List physical disk model, media type, health status and size together with volume capacity and free-space percentage without deleting files or changing storage configuration.
- - - - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Disk -PrivacyMode -ExportMarkdownTo change the low-free-space threshold in the standalone module:
-pwsh -NoProfile -File .\scripts\disk-health.ps1 `
- -LowFreeSpacePercent 20Disk model, reported media type, operational health and total size from built-in Windows storage sources.
Drive letter or mount context, file system, total capacity, free space and free-space percentage.
A warning is generated when a volume falls below the configured threshold, which is 15% by default.
Permission or platform limitations are reported instead of silently presenting missing storage data as healthy.
Windows Update, browser caches, application installers, paging and crash-dump creation all need storage. A nearly full system volume can therefore contribute to failures outside a file-management workflow.
-Fifteen percent of a small drive and fifteen percent of a multi-terabyte drive represent very different absolute capacities. Use the warning as a prompt to review both values and the workload.
-The report shows health values exposed by Windows. It does not perform a surface scan, read vendor SMART attributes directly or stress the device. A disk can still require vendor diagnostics when symptoms persist.
-Systems with multiple disks, Storage Spaces, virtual disks or removable media can have a more complex relationship between physical devices and drive letters. Preserve the full report for context.
- -Collect a local security posture snapshot for Domain, Private and Public Firewall profiles together with Microsoft Defender, Secure Boot, TPM and BitLocker state.
- - - - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Security -PrivacyMode -ExportMarkdownThe combined runner writes a local report and places security findings near the top. Privacy Mode redacts common identifying values, but the report should still be checked manually before sharing.
- -Enabled state for Domain, Private and Public profiles, reported separately so one disabled profile is not confused with all profiles being disabled.
Available component and protection status from built-in read-only Windows sources.
Availability of Secure Boot and Trusted Platform Module information where Windows exposes it to the current user.
Volume protection state without reading recovery keys, key protectors or other secret material.
Windows maintains separate Domain, Private and Public profiles. A disabled profile may not be the currently active network profile, but it is still useful context for policy review.
-Another endpoint security product or centrally managed policy may control the expected Firewall state. The report identifies state but does not determine the organization’s intended configuration.
-A WARN finding means the state deserves review. It does not automatically mean that enabling a feature is safe on every managed, specialized or test system.
-Firewall, Defender, Secure Boot, TPM and BitLocker measure different layers of protection. One enabled feature does not compensate for every other disabled feature, and one unavailable source does not prove that protection is absent.
- -Take a one-time read-only snapshot of available physical memory, pagefile usage, CPU load and the processes using the most working-set memory.
- - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Performance -PrivacyMode -ExportMarkdownFor custom thresholds and a longer process list, run the standalone module:
-pwsh -NoProfile -File .\scripts\performance-snapshot.ps1 `
- -TopProcessCount 20 -LowMemoryPercent 20 -HighCpuPercent 90Total and available RAM plus the percentage still available at the moment the snapshot is taken.
Current pagefile allocation and usage where Windows exposes the data.
A point-in-time CPU load value used to flag unusually high load at the moment of collection.
Processes ranked by working set and cumulative CPU time. Process command lines, owners and executable paths are not collected.
Windows intentionally uses free RAM for cache and can reclaim it when applications need memory. A high used percentage is more concerning when available memory is very low, pagefile use is rising and the user sees slowdowns or allocation failures.
-The process list ranks working-set memory currently resident in physical RAM. Shared pages, cached data and memory that has been paged out can make other tools show different totals.
-A long-running process may have a high cumulative CPU total even when it is idle during the snapshot. Use the current CPU load together with the process list rather than treating cumulative time as a live percentage.
-A memory leak is normally established by observing growth over time under comparable conditions. This report captures evidence at one moment and is best used as a starting point or reproducible support attachment.
- -Compare active adapters, gateways, route metrics, DNS, DHCP and WinINET or WinHTTP proxy state without changing the Windows network stack.
- - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Network -PrivacyMode -ExportMarkdownThe report places default routes first, then includes adapter, address, DNS, DHCP, gateway, route, proxy and basic reachability context. Privacy Mode replaces common identifiers in the combined report.
- -Active adapters, IPv4 and IPv6 addresses, DHCP state, DHCP server and DNS suffix or search-list context.
Default routes appear first with next hop, interface and effective metric, followed by a bounded list of active routes.
Configured DNS servers plus simple gateway, DNS-resolution and internet-reachability checks.
Current-user WinINET state and read-only WinHTTP proxy output. Proxy credentials and sensitive URL query values are removed.
For competing default routes, the path with the lower effective metric is usually preferred. The metric must still be considered together with interface state and the actual software using the network.
-Hypervisors, containers, VPN clients and security products may create virtual interfaces and route entries. Their presence is not automatically a fault; compare the result with installed and currently running software.
-Applications may use different Windows networking APIs. A browser can use current-user WinINET settings while a service or command-line component uses WinHTTP, so one proxy can be configured while the other is direct.
-A successful gateway test with failed DNS resolution points in a different direction than a failed gateway test. These checks are deliberately simple and should be combined with the rest of the report.
- -Inspect W32Time state, start mode, timezone, local and UTC clock values, configured source, verbose status and optional events without starting the service or changing its configuration.
- - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Time -PrivacyMode -ExportMarkdownThe combined report summarizes the current time-service context. For additional event evidence, the standalone module can include recent Time-Service warnings and errors:
-pwsh -NoProfile -File .\scripts\time-sync-diagnostics.ps1 `
- -IncludeTimeServiceEventsCurrent W32Time status and start mode, including whether the computer is domain joined.
Timezone plus current local and UTC values to make obvious offsets or display confusion easier to spot.
The source reported by w32tm.exe /query /source, collected without changing peers or requesting synchronization.
Read-only status details and optional recent Time-Service warning or error events.
On a non-domain computer, Windows may start the time service when needed rather than keeping it continuously active. Service state should be considered together with start mode, source, status and recent events.
-Domain-joined systems normally depend on the domain time hierarchy. A stopped service or unavailable source on such a machine deserves closer review than the same state on an isolated home computer.
-A local hardware clock, unavailable source or unexpected provider can explain why synchronization is not occurring. The source alone is not a complete diagnosis, but it narrows the investigation.
-A correct UTC clock with an incorrect timezone can look like time drift to the user. Compare both local and UTC values before assuming the synchronization service is at fault.
- -Inspect recent installed updates, common reboot indicators and Windows Update related service state without starting an update scan, installing anything or resetting update components.
- - -pwsh -NoProfile -File .\Invoke-WindowsDiagnostics.ps1 `
- -Updates -PrivacyMode -ExportMarkdownFor optional recent update-related Event Log entries, run the standalone module:
-pwsh -NoProfile -File .\scripts\windows-update-check.ps1 `
- -IncludeEventLog -SinceDays 14 -MaxEvents 20The operating-system version and build provide context for update history and support discussions.
Recent update records exposed by built-in Windows read-only sources.
Common registry-backed indicators used by Windows components and servicing processes to signal that a restart may be required.
Current state and start mode for relevant Windows Update and servicing services without starting or stopping them.
Recent Windows Update related warnings and errors when the standalone option is requested.
Unavailable sources, reboot indicators and other notable state are summarized before the detailed output.
Different Windows components can leave separate indicators. One indicator may remain after the operation that created it, while another may appear only during a specific servicing stage.
-Recent installed updates, installer activity and Event Log timestamps help determine whether the reboot state is current and relevant to the reported problem.
-Some Windows Update services do not run continuously. A stopped service is not automatically a fault; start mode, recent events and the observed update behavior matter.
-The diagnostic reads local history and state. It does not contact Microsoft Update or prove that no newer update is available.
- -SYSTEM READY
-A read-only PowerShell diagnostics toolkit with a responsive terminal interface, local reports, Privacy Mode and no telemetry.
- -
-
- 01 / INTERFACE
-Run the entry point without switches. Select the diagnostic areas, choose report options and review the result without leaving the TUI.
-Toggle ten diagnostic areas, Privacy Mode, Markdown export and the output directory.
-↑↓navigateSpacetoggle
-Only reviewed diagnostic operations are launched. The toolkit does not apply fixes or reconfigure Windows.
-AallRrecommendedEnterrun
-See elapsed time, report paths and aggregated WARN and ERROR counts before opening the report.
-EntermenuEscexit
-
-
- 02 / QUICK START
-No installer and no third-party PowerShell modules. The built-in Windows PowerShell 5.1 is enough.
-The planned v0.1.0-beta publication will add a one-line bootstrap that downloads a fixed GitHub Release ZIP and verifies its SHA-256 checksum before execution. Until publication, use the clone workflow. The bootstrap still requires trust in the file delivered through GitHub Pages.
PS> git clone https://github.com/0x0bug/windows-diagnostics-toolkit.git
-PS> cd windows-diagnostics-toolkit
-PS> .\Invoke-WindowsDiagnostics.ps1Available when v0.1.0-beta is published. Review every report before publication; Privacy Mode cannot guarantee removal of arbitrary sensitive text in Windows Event Log messages.
PS> irm https://0x0bug.github.io/windows-diagnostics-toolkit/run.ps1 | iex
-
-PS> irm https://0x0bug.github.io/windows-diagnostics-toolkit/run.ps1 -OutFile .\wdt-run.ps1
-PS> notepad .\wdt-run.ps1
-PS> .\wdt-run.ps103 / DIAGNOSTICS
-Ten diagnostic modules are grouped here into six troubleshooting areas. Collect broad context or run only the module related to the problem; the findings summary appears before the detailed sections.
-04 / PRIVACY
-Reports stay in the selected output directory. Privacy Mode replaces common identifying values with stable per-report tokens.
-ComputerName : <HOST-1>
-UserName : <USER-1>
-IPv4Address : <IP-1>
-MacAddress : <MAC-1>
-DeviceId : <ID-1>[!] Process, application and dump-file names remain visible because they are diagnostically useful.
-05 / GUIDES
-Each guide explains which module to run, what evidence it collects, how to interpret the output and what the toolkit intentionally leaves untouched.
-06 / FAQ
-No. Production diagnostics collect and report state without applying automatic fixes, changing services, editing the registry or reconfiguring the network.
Automatic mode uses Unicode only for compatible interactive UTF-8 output. OEM encodings such as cp866, redirected output and unsupported hosts receive the printable ASCII fallback.
No. Resize events redraw the current interface and preserve the current selection. A running diagnostic operation is not restarted.
Reports are written to the selected output directory. Nothing is uploaded automatically.
No. WARN describes observed state that deserves review. A module execution failure is reported separately with a non-zero exit code.
READY / RUN
-Open source, dependency-free and designed to produce evidence you can actually share.
-