en-US/about_EndpointForge.help.txt

TOPIC
    about_EndpointForge
 
SHORT DESCRIPTION
    Enterprise-safe Windows endpoint inventory, health, compliance, remediation, and reporting.
 
LONG DESCRIPTION
    EndpointForge is a local endpoint automation module intended for execution through
    Intune, Configuration Manager, RMM systems, scheduled tasks, or PowerShell remoting.
 
    Read-only commands return structured objects. Show-EFEndpointSummary provides a
    terminal view for people without changing the underlying automation contract.
    Show-EFMenu provides a guided interactive path across assessment, planning, preview,
    guarded remediation, baseline authoring, and export. Remediation supports WhatIf and
    Confirm, requires elevation when changes are needed, and modifies only controls
    explicitly marked Remediable.
 
    The module does not reboot endpoints, enable BitLocker, change firmware, clear TPMs,
    install software, query Win32_Product, or download and execute remote content.
 
60-SECOND FIRST RUN
    Install for the current user with one of these commands:
 
        Install-PSResource -Name EndpointForge -Scope CurrentUser
 
        Install-Module -Name EndpointForge -Scope CurrentUser
 
    Then open the guided operator menu:
 
        Import-Module EndpointForge
        Show-EFMenu
 
    The menu starts with read-only actions and clearly labels actions that write files or
    can change the endpoint. For a direct read-only check instead:
 
        Get-EFEndpointSummary | Show-EFEndpointSummary -Detailed
 
    Use -NoColor for plain text, -NoProgress for quiet collection, and -PassThru to
    receive one menu-session object after quitting.
 
COMMAND LAYERS
    Show-EFMenu is the interactive operator layer. It keeps the current baseline,
    assessment, plan, preview, remediation result, and export path together for one menu
    session. It is host-output only by default. Use the direct object commands below for
    unattended automation.
 
    Menu remediation always generates a fresh plan, lets the operator select automatic
    controls, runs WhatIf, requires Administrator access, and then requires the exact
    APPLY acknowledgement. -NoPause never bypasses those safeguards. The menu never
    restarts the endpoint.
 
    Get-EFEndpointSummary combines identity, health, restart, compliance, and collection
    quality into one pipeline-friendly object. Use -IncludeSoftware only when the larger
    software payload is needed. Use -NoProgress in non-interactive hosts.
 
    Show-EFEndpointSummary renders the summary for a person. It accepts summary objects
    from the pipeline or can collect its own summary. Use -PassThru to preserve the input
    object in the pipeline. Scripts should consume Get-EFEndpointSummary output, not parse
    the rendered terminal text.
 
    Test-EFEndpointCompliance returns a Boolean by default and can be used directly in an
    if statement. Get-EFComplianceReport returns the full report, including Results,
    Score, and ExitCode. Test-EFEndpointCompliance -PassThru is an equivalent way to ask
    for that report.
 
    Get-EFRemediationPlan explains what is compliant, actionable, non-remediable, or
    unavailable before changes begin. -IncludeCompliant returns the full decision set.
    -ControlId limits planning to explicitly selected controls.
 
RECOMMENDED OPERATOR WORKFLOW
    Use observe, validate, plan, preview, apply, verify, and export in that order.
 
    Interactive workflow:
 
        Show-EFMenu
 
    Object-first or unattended workflow:
 
    1. Observe:
 
        $summary = Get-EFEndpointSummary
        $summary | Show-EFEndpointSummary -Detailed
 
    2. Validate the selected baseline:
 
        $baseline = Get-EFBaseline -Name EnterpriseRecommended
        $baseline | Test-EFBaseline
 
    3. Review the change plan:
 
        $plan = Get-EFRemediationPlan -Baseline $baseline -IncludeCompliant
        $plan
 
    4. Preview and apply approved controls:
 
        $ids = 'EF-FW-DOMAIN', 'EF-UAC-ENABLED'
        Invoke-EFEndpointRemediation -Baseline $baseline -ControlId $ids -WhatIf
        $result = Invoke-EFEndpointRemediation -Baseline $baseline -ControlId $ids
 
    5. Verify independently and export evidence:
 
        $verification = Get-EFComplianceReport -Baseline $baseline -ControlId $ids
        $verification | Export-EFEndpointReport -Path .\verification.json -Force
 
    Run the apply step from an elevated PowerShell session. Keep confirmation enabled
    for interactive work. Use -Confirm:$false only in an approved non-interactive rollout
    after testing the plan and WhatIf result in a representative pilot ring.
 
AUTOMATION RESULTS
    Test-EFEndpointCompliance returns $true only when every applicable selected control
    is compliant and no evaluation errors occurred. It returns $false otherwise.
 
    Compliance reports from Get-EFComplianceReport expose ExitCode:
 
        0 All applicable controls are compliant
        2 One or more controls are noncompliant
        3 One or more controls could not be evaluated
 
    Remediation reports expose ExitCode:
 
        0 Successfully remediated or no change required
        2 Noncompliant controls remain
        3 Evaluation, remediation, or verification failure
 
    Health reports expose ExitCode:
 
        0 Healthy
        1 Warning
        2 Critical
 
    Module functions never exit the hosting PowerShell process. A wrapper script should
    read ExitCode and call exit only when required by its management platform.
 
ELEVATION AND CAPABILITY RESULTS
    Most inventory, summary, health, and compliance data is available to standard users.
    Windows may protect read-only BitLocker, TPM, Secure Boot, and optional-feature
    providers behind administrator privileges. Remediation requires elevation whenever a
    change is needed.
 
    NonCompliant means the current value was read and did not match the baseline.
 
    NotApplicable means the feature, service, cmdlet, or hardware capability is absent or
    unsupported. Confirm that the baseline is appropriate for that device class.
 
    Error means EndpointForge could not establish the current value. Read the result
    message, check elevation and platform capability, and rerun. Do not treat Error as
    compliant merely to obtain a passing score.
 
TROUBLESHOOTING
    If a result says Requires elevation, Access denied, Unable to set proper privileges,
    or that TPM status was not returned:
 
        1. Open Windows Terminal or PowerShell with Run as administrator.
        2. Rerun Get-EFEndpointSummary | Show-EFEndpointSummary -Detailed.
        3. If access is still denied, check MDM, Group Policy, Defender tamper protection,
           and application-control policy.
 
    To inspect unavailable compliance controls without relying on terminal color:
 
        $report = Get-EFComplianceReport
        $report.Results |
            Where-Object Status -in 'Error', 'NotApplicable' |
            Format-Table ControlId, Status, Message -Wrap
 
    If Secure Boot, TPM, BitLocker, Defender, or optional-feature data remains
    NotApplicable after an elevated run, the capability may not exist on that Windows
    edition, Server role, virtual machine, firmware mode, or hardware model. Use a
    device-class-specific baseline when the absence is intentional.
 
    If remediation reports VerificationFailed, check whether Group Policy, MDM, tamper
    protection, or a service immediately restored the original state. Also inspect:
 
        $result.Results |
            Where-Object Outcome -in 'Failed','EvaluationFailed','VerificationFailed'
        $result.RebootRequired
        Get-EFPendingReboot
 
    EndpointForge never restarts the device. After resolving the owner policy or
    completing an approved restart, run Get-EFComplianceReport again.
 
    If the module installs but does not import, inspect the discovered version and
    effective execution policy:
 
        Get-Module -ListAvailable EndpointForge | Select-Object Name,Version,ModuleBase
        Get-ExecutionPolicy -List
        Import-Module EndpointForge -Verbose
 
    Follow organizational application-control and execution-policy requirements. Do not
    bypass a centrally managed policy. Reinstalling a module does not override Group
    Policy.
 
BASELINES
    EnterpriseRecommended is included. Get-EFBaseline loads built-in or custom JSON.
    Test-EFBaseline validates by built-in name, JSON path, or pipeline InputObject without
    evaluating the endpoint.
 
    New-EFBaseline creates a valid starting file. Template accepts Starter,
    EnterpriseRecommended, or AuditOnly. The command supports WhatIf and will not replace
    an existing file unless Force is specified. For example:
 
        New-EFBaseline -Name Contoso.Workstation -Template Starter `
            -Path .\Contoso.Workstation.json
        Test-EFBaseline -Path .\Contoso.Workstation.json
 
    Validate after every edit and before deployment. Custom baselines can define
    Registry, Service, FirewallProfile, Defender, WindowsOptionalFeature, BitLocker,
    SecureBoot, and Tpm controls.
 
LOGGING
    File logging is disabled by default. Set-EFConfiguration can enable newline-delimited
    JSON logging for the current process. Environment variables in LogPath are expanded
    at write time.
 
SEE ALSO
    Show-EFMenu
    Get-EFEndpointSummary
    Show-EFEndpointSummary
    Get-EFEndpointInventory
    Get-EFEndpointHealth
    Get-EFBaseline
    New-EFBaseline
    Test-EFBaseline
    Test-EFEndpointCompliance
    Get-EFComplianceReport
    Get-EFRemediationPlan
    Invoke-EFEndpointRemediation
    Export-EFEndpointReport