en-US/about_EndpointForge.help.txt
|
TOPIC
about_EndpointForge SHORT DESCRIPTION Beginner-friendly Windows computer checkups, safe fix previews, comparisons, and reports. LONG DESCRIPTION A checklist is simply a list of Windows settings and the expected value for each setting. Selecting one does not apply it or change Windows. EndpointForge helps a person answer four practical questions about a Windows computer: 1. Does this computer look healthy? 2. Do important Windows settings match the selected checklist? 3. Which problems can EndpointForge safely preview and fix? 4. What changed between an earlier check and a later check? The guided menu uses everyday language and labels whether each choice reads information, creates a file, or can change a Windows setting. Normal checks do not change Windows. A supported fix is never applied until it has been selected, previewed, and explicitly approved. EndpointForge works in Windows PowerShell 5.1 and PowerShell 7 on supported Windows client and server versions. Its commands can also be used in approved scripts, scheduled tasks, Intune, Configuration Manager, RMM systems, and PowerShell remote sessions. FIRST RUN Install EndpointForge for the current Windows user: Install-Module -Name EndpointForge -Scope CurrentUser Import it and open the guided menu: Import-Module EndpointForge Show-EFMenu Start with menu option 1, Check this computer now. The check reads computer health, restart status, security information, and selected Windows settings. It does not change Windows. Some protected information and all approved fixes require a PowerShell window opened with Run as administrator. A standard-user window can still run normal checks and no-change previews. EVERYDAY TERMS EndpointForge uses plain wording in its menu. PowerShell commands retain several technical names so existing scripts remain compatible. Checklist A list of Windows settings and the expected value for each setting. Selecting a checklist does not apply it and does not change Windows. Baseline The script-facing name for a checklist. A parameter named Baseline asks which checklist to use. Checklist item One setting in a checklist. Control The script-facing name for a checklist item. ControlId is the item's stable name for scripts, such as EF-FW-DOMAIN. Matches EndpointForge read the current value and it equals the checklist value. Compliance The technical name for comparing current settings with a checklist. Compliant means a setting matches. NonCompliant means it was read successfully but does not match. Compliance checking by itself never changes Windows. Supported fix A narrow setting change EndpointForge knows how to preview, apply, and check again. Many findings are intentionally report-only. Remediation The script-facing name for applying a supported fix. A remediation plan only explains possible actions; it does not change Windows. Preview or WhatIf A no-change rehearsal. PowerShell calls this WhatIf and uses the -WhatIf switch. A preview shows what a supported fix would try to change without making the change. Could not check Windows did not provide a definite answer. This is not treated as passing, matching, or fixed. Administrator or elevated session A PowerShell window opened with Run as administrator. Windows requires this extra permission for protected information and setting changes. Endpoint An IT term for a managed computer. Receipt A record of an attempted fix, including the value before, the value afterward, the result, safety notes, and recovery guidance. HTML report A self-contained web-page file intended for a person to read in a browser. JSON report A structured data file intended for scripts and support tools. It preserves more nested technical detail than a human-readable report. GOAL-BASED MENU Show-EFMenu organizes work by the result a person wants: 1. Check this computer now Reads information and does not change Windows. 2. Understand the latest results Shows a simple summary, detailed explanations, earlier-versus-later changes, and computer details. 3. Fix selected problems safely Builds a plan, lets the user select supported fixes, performs a mandatory preview, and asks for final approval before any setting change. 4. Save reports or compare checks Creates a readable HTML report, a detailed JSON report, or a comparison when the user chooses that action. 5. Check other computers Runs read-only checks on computers that were already prepared for approved PowerShell remote management. It never runs remote fixes. 6. Change what EndpointForge checks Selects, loads, validates, or creates checklist files. Selecting a checklist never applies its settings. A. Tools for IT scripts and troubleshooting H. Help that explains every choice Q. Exit The menu keeps results only for the current menu session unless a report is saved. Changing the checklist clears earlier menu results so results from different checklists are not mistaken for one another. READINESS Readiness is a no-change preflight. It explains what the current PowerShell window is prepared to check or fix: Get-EFEndpointReadiness It checks whether the platform is Windows, whether the checklist is valid, whether the current window has Administrator permission, whether it is a remote session, and whether Windows provides the commands required by each checklist item. It does not read the actual policy values and does not change anything. A readiness result with limits does not mean the whole check failed. It means some protected or unavailable items may be reported as Could not check or report-only. Review the result details before deciding whether to reopen PowerShell with Run as administrator. RUN A COMPUTER CHECK The recommended read-only script command is: $check = Get-EFEndpointSummary -NoProgress $check | Show-EFEndpointSummary Show every finding and its explanation: $check | Show-EFEndpointSummary -Detailed Get-EFEndpointSummary returns structured data for scripts. Show-EFEndpointSummary is the display for people. Scripts should read object properties instead of parsing the displayed text. Include installed software only when it is needed because collection takes longer and the resulting report contains more private device information: $check = Get-EFEndpointSummary -IncludeSoftware -NoProgress UNDERSTAND RESULTS The terminal translates script statuses into these descriptions: Looks good The health and checklist items that were read do not need attention. Needs attention A warning or checklist difference was found. Urgent attention A critical health or security difference was found. Could not check everything One or more answers were unavailable, protected, or failed to load. Not used on this computer The feature is absent or does not apply to this Windows computer. Unknown information is never silently counted as healthy. Review WhyItMatters, HowChecked, WhatWouldChange, ManualAction, SafetyNotes, and RecoveryGuidance when those explanation fields are present. SAFE FIX FLOW Menu option 3 is the safest interactive path. It always follows this order: 1. Run or reuse a read-only computer check. 2. Explain each item that needs attention. 3. Separate supported fixes from manual review and unavailable information. 4. Let the user select specific supported fixes. 5. Run a fresh WhatIf preview that cannot change Windows. 6. Stop if the preview is incomplete or reports a failure. 7. Require a PowerShell window opened with Run as administrator. 8. Show the computer, selected items, current values, expected values, and possible restart impact. 9. Require the user to type APPLY exactly. 10. Apply only the selected items and check their new values. 11. Run a fresh computer check and show a before-and-after comparison. A standard-user window may complete the preview. It then explains how to reopen PowerShell as Administrator. EndpointForge does not restart itself with higher permission and does not bypass Windows security prompts. The equivalent script workflow is: $plan = Get-EFRemediationPlan -NoProgress $approvedIds = $plan.Steps | Where-Object CanFixAutomatically | Select-Object -ExpandProperty ControlId Invoke-EFEndpointRemediation -ControlId $approvedIds -WhatIf -NoProgress # Run only after approval, from an Administrator window. $result = Invoke-EFEndpointRemediation ` -ControlId $approvedIds -Confirm:$false -NoProgress $verification = Get-EFComplianceReport -ControlId $approvedIds -NoProgress The low-level apply command uses normal PowerShell confirmation behavior. Scripts are responsible for approval, selection, testing, and organizational change control. The menu adds the extra exact APPLY acknowledgement. The built-in EnterpriseRecommended checklist can offer narrow supported fixes for Windows Firewall profiles, User Account Control, Microsoft Defender real-time protection when Defender manages it, the SMB 1.0 optional feature, and the Windows Update service start setting. BitLocker, Secure Boot, and Trusted Platform Module readiness are report-only. EndpointForge will not change them automatically. RECEIPTS, RESTARTS, AND RECOVERY Each preview or applied fix returns a receipt. It records the before value, desired value, after value, whether a change was applied, what changed, and available safety and recovery guidance. EndpointForge never restarts Windows automatically. A receipt may say that an approved restart should be scheduled through the organization's normal process. EndpointForge does not promise automatic rollback. Restoring a saved value is not always safe because Group Policy, mobile-device management, Defender tamper protection, a service dependency, another security product, or a later Windows change may own the setting. Use the receipt's before value and RecoveryGuidance with an approved recovery process. Identify and use the owning management system when a centrally managed setting does not stay changed. SAVE REPORTS Save a human-readable HTML report: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.html The HTML file is self-contained. It uses embedded styling, loads no JavaScript, fonts, or internet content, and encodes report values before placing them in the page. Save detailed JSON data for scripts or support tools: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.json CSV and CLIXML are also supported. The file extension selects the format. Existing files require -Force. Export supports -WhatIf so a script can preview the file action. Reports may contain computer names, hardware, network addresses, installed software, security posture, checklist details, and change evidence. Store reports only in an approved location with least-privilege permissions and appropriate retention. COMPARE EARLIER AND LATER CHECKS Compare two saved JSON reports: $difference = Compare-EFEndpointSummary ` -Before .\before.json -After .\after.json $difference Or compare two in-memory results: $before = Get-EFEndpointSummary -NoProgress # Approved maintenance happens here. $after = Get-EFEndpointSummary -NoProgress Compare-EFEndpointSummary -Before $before -After $after The comparison separates definite improvements, newly detected problems, unchanged items, newly available information, and items the later check could not read. A missing or incomplete later result is never described as fixed. By default, checks with different computer names are rejected. Use -AllowDifferentComputer only for an intentional side-by-side view, not to measure progress. A warning is also returned when the checklist name or version changed, because that is not a like-for-like comparison. CHECK OTHER COMPUTERS WITHOUT CHANGING THEM Get-EFFleetSummary checks several Windows computers and returns successful results and connection failures in one object: $fleet = Get-EFFleetSummary -ComputerName PC-101,PC-102 $fleet.Results $fleet.Failures This command is strictly read-only. Before it can work, every target computer must already: - allow PowerShell remoting under the organization's policy; - have EndpointForge 0.4.0 or later installed; and - allow the connecting account to run the check. EndpointForge does not install itself remotely, enable WinRM, change TrustedHosts, adjust firewall rules, or run remote fixes. It reports connection failures alongside successful results. Use a credential only when the approved environment requires one: $credential = Get-Credential Get-EFFleetSummary ` -ComputerName (Get-Content .\computers.txt) ` -Credential $credential The credential is used for the remote connection and is not stored in the returned fleet report. Check an affected computer directly before approving any fix. CHECKLISTS FOR AN ORGANIZATION Load the built-in checklist: $checklist = Get-EFBaseline -Name EnterpriseRecommended Create an editable starter file and validate it: New-EFBaseline ` -Name Contoso.Workstation ` -Template Starter ` -Path .\checklists\Contoso.Workstation.json Test-EFBaseline ` -Path .\checklists\Contoso.Workstation.json ` -PassThru Use the validated file for a read-only check: Get-EFEndpointSummary ` -Baseline .\checklists\Contoso.Workstation.json ` -NoProgress New-EFBaseline creates a starting file. It is not a substitute for organizational review and testing. Template accepts Starter, EnterpriseRecommended, or AuditOnly. The command supports -WhatIf and will not replace an existing file unless -Force is used. Custom checklist files are privileged configuration input. Review them, store them in source control, and protect them from untrusted writes before an Administrator process uses them. Validate after every edit and before every deployment. EndpointForge supports Registry, Service, FirewallProfile, Defender, WindowsOptionalFeature, BitLocker, SecureBoot, and Tpm checklist items. BitLocker, SecureBoot, and Tpm items are report-only. COMMANDS FOR SCRIPTS Commands whose names begin with Get or Test return PowerShell objects and do not change Windows. Show commands display information for a person. New and Export commands write files only when requested. Invoke-EFEndpointRemediation is the command that can change supported Windows settings; -WhatIf turns it into a no-change preview. Useful discovery commands are: Get-Command -Module EndpointForge Get-Help Show-EFMenu -Full Get-Help Get-EFEndpointSummary -Full Get-Help Invoke-EFEndpointRemediation -Full Test-EFEndpointCompliance returns $true only when every applicable selected item matches and no checking error occurred. Add -PassThru, or use Get-EFComplianceReport, when a script needs details, scores, or an ExitCode. SCRIPT EXIT CODES EndpointForge commands do not exit the hosting PowerShell process. They return an ExitCode property. A wrapper script should call exit only when its management system requires a process exit code. Combined computer check and fleet check: 0 Checked items look good. 1 A warning or partial information needs attention. 2 A critical issue or checklist difference was found. 3 Required information could not be collected, or a fleet target failed. Detailed compliance report: 0 All applicable checked items match. 2 One or more checked items do not match. 3 One or more checked items could not be evaluated. Remediation report: 0 Approved fixes were verified, or no change was needed. 2 One or more selected items still do not match. A WhatIf preview normally leaves an item unchanged, so review PreviewCount as well as ExitCode. 3 Checking, applying, or verifying one or more selected items failed. Operational health report: 0 Healthy. 1 Warning. 2 Critical. SECURITY BOUNDARIES EndpointForge intentionally does not: - restart Windows; - install updates or other software; - turn on BitLocker or start drive encryption; - change Secure Boot, firmware, or Trusted Platform Module settings; - clear a Trusted Platform Module; - install itself on another computer or enable PowerShell remoting; - query Win32_Product for installed software; - download and execute remote content; - bypass Group Policy, mobile-device management, Defender tamper protection, application-control policy, or another security product; - apply an automatic menu change without selection, preview, Administrator permission, and exact APPLY acknowledgement; or - promise automatic rollback. Installed software is read from Windows uninstall registry records. Unsupported or unavailable Windows features are reported instead of silently omitted. Follow organizational execution-policy and application-control requirements. Do not bypass a centrally managed policy. Reinstalling this module does not override Group Policy. TROUBLESHOOTING If a result says Could not check, Access denied, Requires elevation, or that a protected security value was not returned: 1. Run Get-EFEndpointReadiness. 2. Open PowerShell with Run as administrator when approved. 3. Run the detailed check again: Get-EFEndpointSummary -NoProgress | Show-EFEndpointSummary -Detailed 4. If the result remains unavailable, confirm that the Windows edition, server role, virtual machine, firmware mode, and hardware support the feature. If a fix reports PartiallyChanged, EndpointForge observed a changed after-value before a later step reported an error. Review the before and after values plus recovery guidance immediately; do not assume the earlier value is still active. If a fix reports VerificationFailed or does not stay changed, Group Policy, Intune, another management product, Defender tamper protection, or a security agent may own the setting. Review the receipt and use the owning system for the lasting change. If a remote computer cannot be reached, confirm its name, network path, remoting policy, connecting-account permission, and installed EndpointForge version. The fleet command will not change those prerequisites. If the module installs but does not import, inspect the discovered version and effective execution policy: Get-Module -ListAvailable EndpointForge | Select-Object Name,Version,ModuleBase Get-ExecutionPolicy -List Import-Module EndpointForge -Verbose LOGGING File logging is disabled by default. Set-EFConfiguration can enable newline-delimited JSON logging for the current PowerShell process: Set-EFConfiguration ` -LogPath '%ProgramData%\EndpointForge\endpointforge.jsonl' ` -LogLevel Information Protect log locations with least-privilege permissions. Logs and reports are separate; reports are written only when Export-EFEndpointReport or a menu save action is used. SEE ALSO Show-EFMenu Get-EFEndpointReadiness Get-EFEndpointSummary Show-EFEndpointSummary Compare-EFEndpointSummary Get-EFFleetSummary Get-EFEndpointInventory Get-EFEndpointHealth Get-EFInstalledSoftware Get-EFPendingReboot Get-EFBaseline New-EFBaseline Test-EFBaseline Test-EFEndpointCompliance Get-EFComplianceReport Get-EFRemediationPlan Invoke-EFEndpointRemediation Export-EFEndpointReport Get-EFConfiguration Set-EFConfiguration |