Gutcheck

0.32.0

Gutcheck - an honest look inside a slow or unstable Windows PC. Performance and stability diagnostics for Windows clients, driven by data-defined Checks. A technician runs one command at a customer site and reads the report on the spot.

Minimum PowerShell version

5.1

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name Gutcheck

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name Gutcheck

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Merlin

Copyright

Package Details

Author(s)

MERLIN

Functions

Invoke-Gutcheck

PSEditions

Desktop Core

Dependencies

This module has no dependencies.

Release Notes

0.32.0 - The User's domain account, and the system files.
- The User's domain account: when its password expires or must be changed, whether it is
locked out, disabled or expired, the wrong passwords the PDC emulator counted, and which
policy applies, a fine-grained one included. A lockout is joined to what on the machine
still holds the old password - drives, Windows services, saved credentials, scheduled
tasks - and the Timeline draws the change, the lockout and the last wrong password.
- The system files: with -RunIntegrityCheck, or in the new Scope "Systemdateien", sfc
verifies the protected files after the component store scan - verify only, never
repair - and the files it found damaged stand in a table, with what to repair first.
- A connect faster than its ping was answered on the way, by a firewall or UTM, and is
said to be; so is a public address that answers ping in under a millisecond.
- A website the browser restarted to send the client hints the server asked for is
followed to its answer, and an abort by the browser after TLS is no failure of the site.
- A printer whose port points at a Server that does not answer; a share a Server refused
again and again; a DNS server's answer to the domain's lookup measured on its own.
- A Run starts in a quarter of the time, and the Report lays out only what is in sight.
- The German Report says Actions, Check and Check-Definition; "Hinweise" is gone.
0.31.0 - Is the user signed in to a Service?
- A Service that answered and refused the sign-in is Denied on its lane of the 30 days,
apart from one that could not be reached: an HTTP 401 or 403 in an application's log,
the Nextcloud journal or a BITS download, a Kerberos ticket refused, a failed sign-in.
The Timeline draws such an hour hollow, or as a cap on a failure.
- Nextcloud: each account says whether a credential is saved for it - by its name in the
credential store, never the secret - and whether its server refused it since. Its
server is asked without credentials whether it is in maintenance and how it wants to be
signed in to.
- OneDrive: the last sign-in of each account, a failed one with its code and meaning.
- A new Check, Kerberos: the user's tickets as klist lists them (never requested), and
for each HTTPS Service the Run reached whether its SPN exists, once or twice.
- Leads join a refusal to its cause on the same Service - a credential missing or
refused, an SPN missing, the Service in maintenance - and a clock that is off to
refused Kerberos tickets. Sign-in Checks say "nicht prüfbar" where the Run is not the
user's own session (ADR-0016).
- Apps & Services draws the printers this machine prints to, through their print
Server's share or their own port, in the colour of the Findings about them.
- Big Picture: the search finds the Timeline's lanes and hours, the day-by-hour grid and
a Server's card on the Weg by its values; Apps & Services is 16:10 and moves smoothly
in full view; a detail stays open while it is scrolled; the drawings have a quiet
ground. Up to 10,000 network disruptions are listed.
- "Begriffe" opens with Gutcheck's principles and concepts and names each term in German
and English.
- Fixed from a real Report: a Lead's gap note no longer claims a cause; a Server that
answers is no stale reference; numbers, units and codes are said in German with their
meaning; Gutcheck's own memory is left out; long event messages are cut in the Report.
0.30.0 - Big Picture, Apps & Services, and what an application logged of its servers.
- "Netzwerk im Bild" is now "Big Picture": its views are tabs, each with a ? for what it
says, a search in the view shown, and zoom by the wheel and the keyboard. The new view
Topologie draws the whole Network Map, from the machine outwards.
- Apps & Services draws the Apps on rings with the Services they use and the Servers
behind them; a click lights the whole chain. A Service has a state of its own, measured
now and logged, and takes the colour of the Findings that name it.
- Findings name the Service they are about - SMB, Remote Desktop, a controller's
services, the logged protocols, each port the Server Check judged, each URL loaded -
and a Lead tells a Server from one of its Services.
- A DFS Namespace is judged as a whole: a target gone while another still answers is a
WARN, a folder no target serves a FAIL (namespace-unreachable), which joins the drives
Lead.
- Failed requests that Windows or an application logged are events on their server's
Service in the 30 days: failed BITS transfers, the SwyxIt! traces, the Nextcloud client
log with its rotated .gz files, and the files the Nextcloud journal still fails on.
Each says the URL in full and an HTTP status with its meaning.
- A Service is called by the name its Check Definition gives its port, else by the name
the port is registered for, else by the Apps that use it. The Finding's card, its copy
text and the Lead say which Service, on which Server, by name and address.
- Royal TS and the Remote Desktop client are Apps, with the servers they reach; the
SwyxIt! server is read from the registry and tested on its ports. A Technician can add
applications to any Scope, and sees and confirms what a Run will look at.
- A Report is confidential (ADR-0006): nothing of the network is withheld from it. The
Definition switches OwnDomainOnly and KeepMessage are gone.
0.29.0 - One Server is one Server, and the Network Map.
- A Server is named and recognised the same way in every Check, Lead, picture and CSV:
in lower case, without a port or a trailing dot, the host of a UNC path; a short name
is one Server with the one FQDN that begins with it, two FQDNs never, though they share
a first label or an address. A name that resolves to several addresses is shown at its
IPv4 one. "Internet" means the same in a Finding as in a Measurement's Zone.
- A Lead now keeps to the Server the Report draws (ADR-0013): two Findings about
fs01.a.example and fs01.b.example no longer support one Lead.
- A Run assembles the Network Map from what the Network and Domain Checks saw - each
adapter with its subnet, gateway, DNS and DHCP servers, the domain's controllers, its
DFS namespaces and where they lead, mapped drives and their shares - and writes it as
network.json beside the CSVs (ADR-0012). "Netzwerk im Bild" draws its servers from
it and shows under the Weg how they hang together, a server only a connection names
without numbers, and "nicht geprüft" where no Check looked.
- The servers, shares, causes, printers and Group Policy extensions a Finding counts say
from when to when and how their events are spread in time: a burst, daily at a time,
every minute, only on working days, only since, none since, scattered. The tallies
show it as a column; findings.csv gains the column Patterns.
- The day-by-hour grid sums up a cell, a day or an hour on the pointer and from the
keyboard, and marks the hours with a FAIL or a WARN. A share a server refused says
which and why.
0.28.0 - More of the network on the Weg, and the past beside the present.
- The Weg groups the servers by subnet: this machine's own, read from each adapter,
then beyond the gateway the other subnets (their prefix assumed), the VPN and the
internet. Each card says the server's other addresses and names, a port where one
value was measured on two, and how many events the 30 days hold for it, from when to
when, in the colour of their worst Finding: the stripe is now, that line the past.
- On the Weg and the 30 days besides SMB: Remote Desktop connections that failed or
dropped; Group Policy, Netlogon, Kerberos and time-sync events about a domain
controller or the time source; the clock offset of the time source and of each
controller, with its sign; each DNS server's answer to the domain's controller
lookup; the SYSVOL answer of each controller; the ping to each mapped drive's server;
the Autodiscover requests; every print server and network printer, at most five.
- The internet probe is OK where it answers and says so in German where it does not.
A server that never answers a ping is not pinged (Server-Eye's console).
- Two controllers logged under the domain's name are no longer drawn as one. A failed
or dropped SMB connection names the address it went to, also where the name has
several. measurements.csv gains the column PrefixLength.
0.27.0 - The network in pictures.
- New chapter "Netzwerk im Bild" under "Netz & Domäne", drawn from what the Run
measured: the way from this machine through its network services (gateway, DNS,
DHCP) to the domain controllers, servers, internet services and websites, each
value in the colour of the Finding it belongs to; 30 days of connection failures per
server with crashes and sign-ins and a day-by-hour strip; a waterfall per website
and HTTPS service; every value ranked, the worst first. Each over the whole window,
and each saying what the Scope left out.
- The numbers beside the Report: measurements.csv and timeline.csv. findings.csv
gains the columns Id and Subjects.
- The admin half sends back everything: the times of its Checks, missing from the
table since 0.25.0, and the network disruptions the timeline is drawn from. A Run
whose admin half sent two times no longer breaks.
- The DHCP server is measured; a Finding about several servers says each one's own
Severity; a ping under a millisecond reads "< 1 ms".

FileList

Version History

Version	Downloads	Last updated
0.32.0 (current version)	11	10/19/2026
0.31.0	8	10/18/2026
0.30.0	9	10/17/2026
0.29.0	10	10/16/2026
0.28.0	7	10/15/2026
0.27.0	9	10/15/2026
0.26.0	8	10/14/2026
0.25.0	8	10/14/2026
0.24.1	4	10/14/2026
0.24.0	11	10/14/2026
0.23.0	8	10/13/2026
0.22.0	7	10/13/2026
0.21.0	6	10/13/2026
0.20.0	8	10/13/2026
0.19.1	8	10/12/2026
0.19.0	5	10/12/2026
0.18.1	5	10/12/2026
0.18.0	6	10/12/2026
0.17.1	4	10/12/2026
0.17.0	7	10/12/2026
0.16.0	8	10/12/2026
0.15.1	17	10/12/2026
0.15.0	7	10/12/2026
0.14.1	8	10/11/2026
0.14.0	8	10/11/2026
0.13.0	8	10/11/2026
0.12.1	9	10/11/2026
0.12.0	6	10/11/2026
0.11.3	7	10/11/2026
0.11.2	9	10/10/2026
0.11.1	9	10/10/2026
0.11	6	10/10/2026
0.10	6	10/10/2026
0.9.1	11	10/10/2026
0.9	9	10/10/2026
0.8.3	6	10/9/2026
0.8.2	5	10/9/2026
0.8.1	4	10/9/2026
0.8	4	10/9/2026
0.7.2	5	10/9/2026
0.7.1	7	10/9/2026
0.6.2	8	10/8/2026
0.6.1	7	10/8/2026
0.6	5	10/8/2026
0.5.2	8	10/7/2026
0.5.1	8	10/7/2026
0.5	5	10/7/2026
0.4	19	9/25/2026
0.3	7	9/25/2026
0.2	7	9/24/2026