en-US/about_EndpointForge.help.txt
|
TOPIC
about_EndpointForge SHORT DESCRIPTION User-friendly Windows computer checkups, safe fix previews, comparisons, and reports. LONG DESCRIPTION A checklist is simply a list of things expected to be true, such as Windows settings, storage, applications, jobs, files, certificates, recent events, or an available network service. Selecting, viewing, creating, or validating one does not run it or change Windows. EndpointForge helps a person answer practical questions such as: 1. Does this computer look healthy? 2. Is a restart waiting, is storage running low, or are updates available? 3. Are expected applications, jobs, files, certificates, and settings in place? 4. Can the computer reach approved DNS, TCP, and web services? 5. Which problems can EndpointForge safely preview and fix? 6. What changed between an earlier check and a later check? The guided menu uses everyday language and labels whether each choice reads information, creates a file, or can change a Windows setting. Normal checks do not change Windows. A supported fix is never applied until it has been selected, previewed, and explicitly approved. EndpointForge works in Windows PowerShell 5.1 and PowerShell 7 on supported Windows client and server versions. Its commands can also be used in approved scripts, scheduled tasks, Intune, Configuration Manager, RMM systems, and PowerShell remote sessions. FIRST RUN Install EndpointForge for the current Windows user: Install-Module -Name EndpointForge -Scope CurrentUser Import it and open the guided menu: Import-Module EndpointForge Show-EFMenu Start with menu option 1, Check this computer now. The check reads computer health, restart status, security information, and selected Windows settings. It does not change Windows. Some protected information and all approved fixes require a PowerShell window opened with Run as administrator. A standard-user window can still run normal checks and no-change previews. EVERYDAY TERMS EndpointForge uses plain wording in its menu. PowerShell commands retain several technical names so existing scripts remain compatible. Checklist A list of things expected to be true, such as settings, storage, applications, jobs, files, certificates, recent events, or an available network service. Selecting a checklist does not run or apply it. Baseline The script-facing name for a checklist. A parameter named Baseline asks which checklist to use. Checklist item One thing to check, such as a setting, restart, update, application, job, file, certificate, event, account relationship, or approved network connection. Control The script-facing name for a checklist item. ControlId is the item's stable name for scripts, such as EF-FW-DOMAIN. Matches EndpointForge read the current value and it equals the checklist value. Compliance The technical name for comparing current settings with a checklist. Compliant means a setting matches. NonCompliant means it was read successfully but does not match. Compliance checking by itself never changes Windows. Supported fix A narrow setting change EndpointForge knows how to preview, apply, and check again. Many findings are intentionally report-only. Remediation The script-facing name for applying a supported fix. A remediation plan only explains possible actions; it does not change Windows. Preview or WhatIf A no-change rehearsal. PowerShell calls this WhatIf and uses the -WhatIf switch. A preview shows what a supported fix would try to change without making the change. Could not check Windows did not provide a definite answer. This is not treated as passing, matching, or fixed. Administrator or elevated session A PowerShell window opened with Run as administrator. Windows requires this extra permission for protected information and setting changes. Endpoint An IT term for a managed computer. Receipt A record of an attempted fix, including the value before, the value afterward, the result, safety notes, and recovery guidance. HTML report A self-contained web-page file intended for a person to read in a browser. JSON report A structured data file intended for scripts and support tools. It preserves more nested technical detail than a human-readable report. GOAL-BASED MENU Show-EFMenu organizes work by the result a person wants: 1. Check this computer now Reads information and does not change Windows. 2. Understand the latest results Shows a simple summary, detailed explanations, earlier-versus-later changes, and computer details. 3. Fix selected problems safely Builds a plan, lets the user select supported fixes, performs a mandatory preview, and asks for final approval before any setting change. 4. Save reports or compare checks Creates a readable HTML report, a detailed JSON report, or a comparison when the user chooses that action. 5. Check other computers Runs non-changing checks on computers already prepared for approved PowerShell remote management. It never runs remote fixes. Network-active checklist items require explicit approval and can create observable activity from every computer. 6. Change what EndpointForge checks Selects, loads, validates, or creates checklist files. Selecting a checklist never applies its settings. A. Tools for IT scripts and troubleshooting H. Help that explains every choice Q. Exit The menu keeps results only for the current menu session unless a report is saved. Changing the checklist clears earlier menu results so results from different checklists are not mistaken for one another. READINESS Readiness is a no-change preflight. It explains what the current PowerShell window is prepared to check or fix: Get-EFEndpointReadiness It checks whether the platform is Windows, whether the checklist is valid, whether the current window has Administrator permission, whether it is a remote session, and whether Windows provides the commands required by each checklist item. It does not read the actual policy values and does not change anything. A readiness result with limits does not mean the whole check failed. It means some protected or unavailable items may be reported as Could not check or report-only. Review the result details before deciding whether to reopen PowerShell with Run as administrator. RUN A COMPUTER CHECK The recommended read-only script command is: $check = Get-EFEndpointSummary -NoProgress $check | Show-EFEndpointSummary Show every finding and its explanation: $check | Show-EFEndpointSummary -Detailed Get-EFEndpointSummary returns structured data for scripts. Show-EFEndpointSummary is the display for people. Scripts should read object properties instead of parsing the displayed text. Include installed software only when it is needed because collection takes longer and the resulting report contains more private device information: $check = Get-EFEndpointSummary -IncludeSoftware -NoProgress UNDERSTAND RESULTS The terminal translates script statuses into these descriptions: Looks good The health and checklist items that were read do not need attention. Needs attention A warning or checklist difference was found. Urgent attention A critical health or security difference was found. Could not check everything One or more answers were unavailable, protected, or failed to load. Not used on this computer The feature is absent or does not apply to this Windows computer. Unknown information is never silently counted as healthy. Review WhyItMatters, HowChecked, WhatWouldChange, ManualAction, SafetyNotes, and RecoveryGuidance when those explanation fields are present. SAFE FIX FLOW Menu option 3 is the safest interactive path. It always follows this order: 1. Run or reuse a read-only computer check. 2. Explain each item that needs attention. 3. Separate supported fixes from manual review and unavailable information. 4. Let the user select specific supported fixes. 5. Run a fresh WhatIf preview that cannot change Windows. 6. Stop if the preview is incomplete or reports a failure. 7. Require a PowerShell window opened with Run as administrator. 8. Show the computer, selected items, current values, expected values, and possible restart impact. 9. Require the user to type APPLY exactly. 10. Apply only the selected items and check their new values. 11. Run a fresh computer check and show a before-and-after comparison. A standard-user window may complete the preview. It then explains how to reopen PowerShell as Administrator. EndpointForge does not restart itself with higher permission and does not bypass Windows security prompts. The equivalent script workflow is: $plan = Get-EFRemediationPlan -NoProgress $approvedIds = $plan.Steps | Where-Object CanFixAutomatically | Select-Object -ExpandProperty ControlId Invoke-EFEndpointRemediation -ControlId $approvedIds -WhatIf -NoProgress # Run only after approval, from an Administrator window. $result = Invoke-EFEndpointRemediation ` -ControlId $approvedIds -Confirm:$false -NoProgress $verification = Get-EFComplianceReport -ControlId $approvedIds -NoProgress The low-level apply command uses normal PowerShell confirmation behavior. Scripts are responsible for approval, selection, testing, and organizational change control. The menu adds the extra exact APPLY acknowledgement. The built-in EnterpriseRecommended checklist can offer narrow supported fixes for Windows Firewall profiles, User Account Control, Microsoft Defender real-time protection when Defender manages it, the SMB 1.0 optional feature, and the Windows Update service start setting. BitLocker, Secure Boot, and Trusted Platform Module readiness are report-only. EndpointForge will not change them automatically. RECEIPTS, RESTARTS, AND RECOVERY Each preview or applied fix returns a receipt. It records the before value, desired value, after value, whether a change was applied, what changed, and available safety and recovery guidance. EndpointForge never restarts Windows automatically. A receipt may say that an approved restart should be scheduled through the organization's normal process. EndpointForge does not promise automatic rollback. Restoring a saved value is not always safe because Group Policy, mobile-device management, Defender tamper protection, a service dependency, another security product, or a later Windows change may own the setting. Use the receipt's before value and RecoveryGuidance with an approved recovery process. Identify and use the owning management system when a centrally managed setting does not stay changed. SAVE REPORTS Save a human-readable HTML report: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.html The HTML file is self-contained. It uses embedded styling, loads no JavaScript, fonts, or internet content, and encodes report values before placing them in the page. Save detailed JSON data for scripts or support tools: Get-EFEndpointSummary -NoProgress | Export-EFEndpointReport -Path .\computer-check.json CSV and CLIXML are also supported. The file extension selects the format. Existing files require -Force. Export supports -WhatIf so a script can preview the file action. Reports may contain computer names, hardware, network addresses, installed software, security posture, checklist details, and change evidence. Store reports only in an approved location with least-privilege permissions and appropriate retention. COMPARE EARLIER AND LATER CHECKS Compare two saved JSON reports: $difference = Compare-EFEndpointSummary ` -Before .\before.json -After .\after.json $difference Or compare two in-memory results: $before = Get-EFEndpointSummary -NoProgress # Approved maintenance happens here. $after = Get-EFEndpointSummary -NoProgress Compare-EFEndpointSummary -Before $before -After $after The comparison separates definite improvements, newly detected problems, unchanged items, newly available information, and items the later check could not read. A missing or incomplete later result is never described as fixed. By default, checks with different computer names are rejected. Use -AllowDifferentComputer only for an intentional side-by-side view, not to measure progress. A warning is also returned when the checklist name or version changed, because that is not a like-for-like comparison. CHECK OTHER COMPUTERS WITHOUT CHANGING THEM Get-EFFleetSummary checks several Windows computers and returns successful results and connection failures in one object: $fleet = Get-EFFleetSummary -ComputerName PC-101,PC-102 $fleet.Results $fleet.Failures This command never changes Windows settings or runs fixes. Network-active checklist items can still create the observable activity explained below. Before it can work, every target computer must already: - allow PowerShell remoting under the organization's policy; - have EndpointForge 0.6.0 or later installed; and - allow the connecting account to run the check. EndpointForge does not install itself remotely, enable WinRM, change TrustedHosts, adjust firewall rules, or run remote fixes. It reports connection failures alongside successful results. TcpPort, DnsResolution, HttpEndpointHealth, WindowsUpdateAvailable, and LocalGroupMembership are the five network-active types. Each remote computer can contact the named TCP destination, name-resolution service, web address, configured Windows Update or WSUS service, or an identity provider while resolving the requested account name. Those systems, firewalls, proxies, or network monitoring tools may record the activity. Get-EFFleetSummary blocks these items until the checklist has been reviewed and -AllowNetworkChecks is supplied: Get-EFFleetSummary ` -ComputerName PC-101,PC-102 ` -Baseline .\checklists\Contoso.EverydayChecks.json ` -AllowNetworkChecks TCP checks send no application data. Name-resolution results omit returned addresses. HTTP checks do not include response headers or read the response body. Update scans return only a count. Local-group results contain only the requested direct-membership answer. A passing answer proves only the exact fact named by the item, not sign-in or complete application health. Use a credential only when the approved environment requires one: $credential = Get-Credential Get-EFFleetSummary ` -ComputerName (Get-Content .\computers.txt) ` -Credential $credential The credential is used for the remote connection and is not stored in the returned fleet report. Check an affected computer directly before approving any fix. CHECKLISTS FOR AN ORGANIZATION Load the built-in checklist: $checklist = Get-EFBaseline -Name EnterpriseRecommended Create an editable starter file and validate it: New-EFBaseline ` -Name Contoso.Workstation ` -Template Starter ` -Path .\checklists\Contoso.Workstation.json Test-EFBaseline ` -Path .\checklists\Contoso.Workstation.json ` -PassThru Create editable report-only examples for computer health, applications, jobs, files, logs, certificates, access, and approved network checks: New-EFBaseline ` -Name Contoso.EverydayChecks ` -Template EverydayChecks ` -Path .\checklists\Contoso.EverydayChecks.json Replace every sample application, job, file path, search text, event source and ID, certificate, account, host, port, and web address before running the new checklist. The installed examples\EverydayChecks.json file explains each property in plain language. Use the validated file for a read-only check. Add -AllowNetworkChecks only after every destination, requested account identity, update option, and purpose has been reviewed and approved: Get-EFEndpointSummary ` -Baseline .\checklists\Contoso.Workstation.json ` -AllowNetworkChecks ` -NoProgress New-EFBaseline creates a starting file. It is not a substitute for organizational review and testing. Template accepts Starter, EnterpriseRecommended, AuditOnly, or EverydayChecks. The command supports -WhatIf and will not replace an existing file unless -Force is used. Custom checklist files are privileged configuration input. Review them, store them in source control, and protect them from untrusted writes before an Administrator process uses them. Validate after every edit and before every deployment. EndpointForge 0.6.0 supports 24 checklist item types. The menu can show this catalog without running a check. WHAT EACH TYPE ANSWERS Registry Does this Windows setting have the expected value? Service Is this Windows service configured and running as expected? FirewallProfile Is Windows Firewall turned on for this network type? Defender Does this Defender protection setting match what is expected? WindowsOptionalFeature Is this Windows feature turned on or off as expected? BitLocker Is this drive protected by BitLocker? SecureBoot Is Secure Boot turned on? Tpm Is the computer security chip present and ready? PendingRestart Does this computer need to restart? DiskSpace Does this drive have enough free space? WindowsUpdateAvailable Is the number of waiting Windows updates within the allowed limit? DefenderSignatureHealth Are Microsoft Defender threat definitions recent? InstalledApplication Does Windows list this application at the expected version? ScheduledTaskHealth Did this scheduled job run successfully and recently? ProcessRunning Is this program currently running? FileExists Does this exact local file exist? FileContainsText Is the expected text near the end of this log file? FileFreshness Has this file been updated recently? WindowsEvent Were enough matching Windows events recorded recently? CertificateExpiry Will this certificate remain valid long enough? TcpPort Can this computer connect to this server and port? DnsResolution Can this computer find this server name? HttpEndpointHealth Is this website or web service responding as expected? LocalGroupMembership Is this approved account directly in this local group? NEW EVERYDAY HEALTH TYPES PendingRestart has no target property. DesiredValue is normally false. EndpointForge reads servicing, Windows Update, pending file replacement, installer, and computer rename indicators. If any indicator cannot be read, it does not guess that no restart is needed. EndpointForge never restarts Windows. DiskSpace uses Drive, which defaults to %SystemDrive% and can be one exact fixed local drive letter. Define MinimumFreePercent from 1 through 99, MinimumFreeGB from 1 through 1,048,576, or both. Both thresholds must pass when both are present. EndpointForge does not delete, compress, or move files. WindowsUpdateAvailable answers whether the number found is less than or equal to MaximumCount, which defaults to 0 and accepts up to 1,000. By default, it counts assigned, non-hidden, uninstalled software updates. IncludeOptional and IncludeDrivers can broaden the scan; both default to false. TimeoutSeconds defaults to 120 and accepts 10 through 600. Only one update item is allowed per checklist. It requires -AllowNetworkChecks and uses the computer's configured Windows Update or WSUS service. It never downloads or installs updates, accepts licenses, changes update settings, or restarts Windows. The scan can start update components, refresh local scan metadata, contact the service, and be recorded. Results contain only a count, not titles, knowledge-base identifiers, or update metadata. An incomplete result, warning, provider failure, or hard timeout is Could not check. DefenderSignatureHealth uses MaximumAgeDays, which defaults to 7 and accepts 0 through 365. EndpointForge does not refresh definitions. If Defender is present but is not the active antivirus provider, the item is Not used on this computer rather than passing. If Defender status cannot be read or does not contain trustworthy signature-age information, the result is Could not check. NEW APPLICATION AND JOB TYPES InstalledApplication requires one exact ApplicationName. Publisher and ProductCode are optional exact filters. Scope defaults to Machine and also accepts CurrentUser or All; Architecture defaults to All and also accepts x64, x86, or User. Machine cannot be combined with User, and CurrentUser cannot be combined with x64 or x86. On Windows Arm, use Architecture All because x64- and x86-specific filtering is unavailable. Use ExactVersion or MinimumVersion, not both. MinimumVersion accepts a Windows-style version with one through four components. Wildcards are rejected, and a checklist can contain at most 32 InstalledApplication items. EndpointForge reads explicit 32-bit, 64-bit, and current-user uninstall registry views; it never queries Win32_Product, launches a repair check, or installs or removes software. CurrentUser means the account running EndpointForge, which can be SYSTEM in a device management platform. It does not inventory portable apps, other user profiles, or packages that have no uninstall record. If a version comparison is requested but Windows supplies no trustworthy comparable version for the matching records, the result is Could not check. ScheduledTaskHealth requires an exact TaskName and MaximumAgeMinutes from 1 through 525,600. TaskPath defaults to \ and must begin and end with a backslash; ExpectedLastTaskResult defaults to 0 and accepts through 4,294,967,295; RequireEnabled defaults to true. EndpointForge reads enabled state, last run time, and result code, and compares age in UTC so daylight-saving changes do not distort it. It never returns task actions or arguments and never changes or runs the task. A missing or never-run task is a known mismatch; unavailable cmdlets, access failures, and untrustworthy task information are Could not check. ProcessRunning requires one exact ProcessName, with or without .exe. Paths, drive names, and wildcards are rejected. Results omit IDs, paths, owners, command lines, modules, and process contents. Process presence does not prove application health. NEW FILE, CERTIFICATE, AND ACCESS TYPES FileFreshness requires one exact local Path and MaximumAgeMinutes from 1 through 525,600. It uses the same no-network, no-wildcard, no-link path rules as FileExists and reads only the last-write time, never file contents. CertificateExpiry requires an exact 40-character hexadecimal Thumbprint. StoreLocation defaults to LocalMachine and can be CurrentUser. StoreName defaults to My and also accepts Root, CA, AuthRoot, TrustedPeople, or TrustedPublisher. MinimumDaysRemaining defaults to 30 and accepts up to 3,650. The store is opened in read-only mode, and NotBefore and NotAfter are compared in UTC using complete days remaining. Results omit subjects, DNS names, raw certificate data, and private-key details. CurrentUser means the account running EndpointForge, which can be SYSTEM. LocalGroupMembership requires exact GroupName and MemberName values or SIDs. TimeoutSeconds defaults to 15 and accepts 10 through 60. EndpointForge resolves only the requested account name to a SID, reads direct group members as raw SIDs, compares at most 4,096 members, and returns only the requested yes-or-no relationship. It does not expand nested groups, resolve or return unrelated names, or add or remove an account. Account-name resolution can contact an organizational identity provider, so this item requires -AllowNetworkChecks. Supplying a direct SID avoids account-name resolution. Use 64-bit PowerShell on 64-bit Windows because the LocalAccounts provider is not available in a 32-bit PowerShell process there. NEW NETWORK TYPES DnsResolution requires one absolute, multi-label DNS HostName, not an IP address or URL. TimeoutMilliseconds defaults to 3,000 and accepts 100 through 30,000. After -AllowNetworkChecks approval, EndpointForge performs one time-limited Windows name-resolution operation and returns only a yes-or-no answer, never the resolved addresses. HttpEndpointHealth requires one exact HTTP or HTTPS Uri without credentials, a query, fragment, or wildcard. Method defaults to Head and can be Get. ExpectedStatusCode defaults to 200 and accepts 100 through 599. AllowRedirects defaults to false. TimeoutMilliseconds defaults to 5,000 and accepts 100 through 30,000. Normal certificate validation remains enabled. EndpointForge uses the configured proxy without proxy credentials, sends no explicit origin credentials or custom headers, does not include response headers in results, and does not read the response body. When redirects are enabled, it follows at most five, and only when each address keeps the same scheme, host, and port and contains no credentials, query, fragment, or wildcard. TcpPort, DnsResolution, HttpEndpointHealth, WindowsUpdateAvailable, and LocalGroupMembership are report-only but observable. Local and fleet commands block them until -AllowNetworkChecks is supplied. A checklist can contain at most 32 network-active items and only one WindowsUpdateAvailable item. Review and approve every destination, identity lookup, update option, and purpose before allowing the checks. PRIVACY AND ANSWER QUALITY FileContainsText returns no matching lines. WindowsEvent returns no event messages or data. Task actions, certificate identity data, process details, unrelated group identities, resolved addresses, HTTP headers and response bodies, and update metadata are omitted. Checklist files still contain their targets, so protect them and their reports according to the organization's data rules. A known absence, such as a missing file, freshness target, task, application, process, certificate thumbprint, local group, or direct membership, is false when Windows successfully supplied the evidence. An ordinarily refused or timed-out TCP or HTTP request and an unresolved name are also false when the check completes normally. An inaccessible source, permission failure, incomplete update scan, warning, ambiguous identity lookup, or hard worker timeout is Could not check. Inactive Defender ownership is Not used on this computer. Missing or uncertain evidence is never silently treated as success. COMMANDS FOR SCRIPTS Commands whose names begin with Get or Test return PowerShell objects and do not change Windows. Show commands display information for a person. New and Export commands write files only when requested. Invoke-EFEndpointRemediation is the command that can change supported Windows settings; -WhatIf turns it into a no-change preview. Useful discovery commands are: Get-Command -Module EndpointForge Get-Help Show-EFMenu -Full Get-Help Get-EFEndpointSummary -Full Get-Help Invoke-EFEndpointRemediation -Full Test-EFEndpointCompliance returns $true only when every applicable selected item matches and no checking error occurred. Add -PassThru, or use Get-EFComplianceReport, when a script needs details, scores, or an ExitCode. SCRIPT EXIT CODES EndpointForge commands do not exit the hosting PowerShell process. They return an ExitCode property. A wrapper script should call exit only when its management system requires a process exit code. Combined computer check and fleet check: 0 Checked items look good. 1 A warning or partial information needs attention. 2 A critical issue or checklist difference was found. 3 Required information could not be collected, or a fleet target failed. Detailed compliance report: 0 All applicable checked items match. 2 One or more checked items do not match. 3 One or more checked items could not be evaluated. Remediation report: 0 Approved fixes were verified, or no change was needed. 2 One or more selected items still do not match. A WhatIf preview normally leaves an item unchanged, so review PreviewCount as well as ExitCode. 3 Checking, applying, or verifying one or more selected items failed. Operational health report: 0 Healthy. 1 Warning. 2 Critical. SECURITY BOUNDARIES EndpointForge intentionally does not: - restart Windows; - install updates or other software; - turn on BitLocker or start drive encryption; - change Secure Boot, firmware, or Trusted Platform Module settings; - clear a Trusted Platform Module; - install itself on another computer or enable PowerShell remoting; - query Win32_Product for installed software; - download and execute remote content; - include matching log lines or Windows event contents in checklist results; - bypass Group Policy, mobile-device management, Defender tamper protection, application-control policy, or another security product; - apply an automatic menu change without selection, preview, Administrator permission, and exact APPLY acknowledgement; or - promise automatic rollback. Installed software is read from Windows uninstall registry records. Unsupported or unavailable Windows features are reported instead of silently omitted. Follow organizational execution-policy and application-control requirements. Do not bypass a centrally managed policy. Reinstalling this module does not override Group Policy. TROUBLESHOOTING If a result says Could not check, Access denied, Requires elevation, or that a protected security value was not returned: 1. Run Get-EFEndpointReadiness. 2. Open PowerShell with Run as administrator when approved. 3. Run the detailed check again: Get-EFEndpointSummary -NoProgress | Show-EFEndpointSummary -Detailed 4. If the result remains unavailable, confirm that the Windows edition, server role, virtual machine, firmware mode, and hardware support the feature. If a fix reports PartiallyChanged, EndpointForge observed a changed after-value before a later step reported an error. Review the before and after values plus recovery guidance immediately; do not assume the earlier value is still active. If a fix reports VerificationFailed or does not stay changed, Group Policy, Intune, another management product, Defender tamper protection, or a security agent may own the setting. Review the receipt and use the owning system for the lasting change. If a remote computer cannot be reached, confirm its name, network path, remoting policy, connecting-account permission, and installed EndpointForge version. The fleet command will not change those prerequisites. If the module installs but does not import, inspect the discovered version and effective execution policy: Get-Module -ListAvailable EndpointForge | Select-Object Name,Version,ModuleBase Get-ExecutionPolicy -List Import-Module EndpointForge -Verbose LOGGING File logging is disabled by default. Set-EFConfiguration can enable newline-delimited JSON logging for the current PowerShell process: Set-EFConfiguration ` -LogPath '%ProgramData%\EndpointForge\endpointforge.jsonl' ` -LogLevel Information Protect log locations with least-privilege permissions. Logs and reports are separate; reports are written only when Export-EFEndpointReport or a menu save action is used. SEE ALSO Show-EFMenu Get-EFEndpointReadiness Get-EFEndpointSummary Show-EFEndpointSummary Compare-EFEndpointSummary Get-EFFleetSummary Get-EFEndpointInventory Get-EFEndpointHealth Get-EFInstalledSoftware Get-EFPendingReboot Get-EFBaseline New-EFBaseline Test-EFBaseline Test-EFEndpointCompliance Get-EFComplianceReport Get-EFRemediationPlan Invoke-EFEndpointRemediation Export-EFEndpointReport Get-EFConfiguration Set-EFConfiguration |