PS C:\WDT> .\Invoke-WindowsDiagnostics.ps1
Collect the Windows state and recent failure context needed for initial troubleshooting across system, performance, network, security, storage, services and updates.
Built for system administrators and support engineers who need consistent evidence before changing the system.
READ-ONLY · LOCAL REPORTS · NO AGENT · PS 5.1 / 7+ · WINDOWS 10 / 11
PS>.\Invoke-WindowsDiagnostics.ps1 -All -PrivacyMode
[WARN]SecurityBitLocker volume not protected
[WARN]TimeLocal clock source reported
[WARN]ServicesOne or more services need attention
[OK]NetworkNo findings
--0 errors · 3 warnings · 7 OK modules
>.\WindowsDiagnosticsReport-20260712-101530.txt
Findings summary appears before detailed evidence.
Preview the current WDT workflow and the structured output produced for a troubleshooting session. This simulation runs only in the browser.
Select modules → Collect locally → Review one report
Select diagnostics
Options
>Output: .\WindowsDiagnosticsReports
Privacy Mode replaces common identifiers. Markdown export adds another format.
Output
↑ ↓ navigate · Space / Enter toggleA all · R recommended · Enter on Run
OK — normal · WARN — review recommended · ERROR — collection failed or Windows reported a fault
Run the same collection without the interactive interface, select only the required modules and write reports to a predictable location.
PS> .\Invoke-WindowsDiagnostics.ps1 -All -PrivacyMode -ExportMarkdown PS> .\Invoke-WindowsDiagnostics.ps1 -Module System,Network -OutputDirectory .\Reports
No installer, no agent and no third-party modules. Administrator rights are optional. Findings do not change the exit code; a non-zero exit code indicates an execution failure.
Download the tagged release archive and checksum from GitHub, verify SHA-256 and inspect the extracted files before execution.
Download ZIP · Download checksum · Release page
SHA-256 ee741a450fa20b0903adec858af446806cba74666fde0f98b1bde85dc0188e0f
Release ZIP verified before extraction
PS> irm https://wdt.digital/run.ps1 | iex
[!] Requires trust in run.ps1 served through GitHub Pages. Inspect it first on managed or sensitive systems.
PS> irm https://wdt.digital/run.ps1 -OutFile .\wdt-run.ps1 PS> notepad .\wdt-run.ps1 PS> .\wdt-run.ps1
PS> git clone https://github.com/0x0bug/windows-diagnostics-toolkit.git PS> cd windows-diagnostics-toolkit PS> .\Invoke-WindowsDiagnostics.ps1
PS> $expected = 'ee741a450fa20b0903adec858af446806cba74666fde0f98b1bde85dc0188e0f' PS> (Get-FileHash .\windows-diagnostics-toolkit-v0.1.0-beta.zip -Algorithm SHA256).Hash.ToLowerInvariant() -eq $expected
The tagged release binds the archive to a published version. SHA-256 detects whether the downloaded ZIP differs from the expected bytes; it does not establish who produced the file. The ZIP checksum does not authenticate bootstrap code already passed to iex.
-Module System
Windows version and build, hardware, uptime and core system context.
Establish the machine baseline before deeper analysis.
-Module Performance
CPU, memory, pagefile, pressure indicators and top processes.
Identify current resource pressure.
-Module Network
Adapters, IP, DNS, DHCP, routes, gateways, proxy and reachability.
Verify the actual traffic path and configuration.
-Module Security
Defender, Firewall, Secure Boot, TPM and BitLocker.
Confirm the observable state of Windows protections.
-Module Disk
Physical disks, volumes, free space and warning thresholds.
Detect capacity pressure and relevant storage state.
-Module Crashes,Events
Crashes, hangs, BugChecks, Event Log evidence and dump metadata.
Collect recent failure evidence from multiple sources.
-Module Services
Services, startup entries and scheduled tasks.
Review execution and startup state.
-Module Updates,Time
Updates, pending reboot indicators and Windows Time state.
Detect conditions affecting deployment, authentication or behaviour.
Every report opens with a findings summary. Severity is based on documented signal rules rather than the raw Windows event level alone.
Generate a report that can be attached to a ticket or shared with another engineer without exposing common host, user and network identifiers.
ComputerName : DESKTOP-4F1QK UserName : a.ivanov IPv4Address : 192.168.1.24 MacAddress : B4-2E-99-0C-7A-11 DeviceId : S-1-5-21-3402…
ComputerName : <HOST-1> UserName : <USER-1> IPv4Address : <IP-1> MacAddress : <MAC-1> DeviceId : <ID-1>
[!] Program names, dump-file names and Event Log messages can still contain sensitive information. Review every report before sharing it.
Collect consistent evidence and review Privacy Mode output before attaching it.
Open guide →Compare current pressure, pagefile state and the highest-impact processes.
Open guide →Review grouped Event Log, Reliability Monitor and dump metadata.
Open guide →Compare adapters, routes, gateways, name resolution and proxy state.
Open guide →No for the standard collection. Some Windows sources expose less detail without elevation; WDT reports unavailable data and continues where possible.
No. Production diagnostics collect and report state without changing services, registry settings, firewall rules or network configuration.
The interactive interface writes to .\WindowsDiagnosticsReports by default. Command-line mode writes to the current directory unless -OutputDirectory is provided.
It replaces common host, user, network and device identifiers with typed tokens. Program names, dump-file names and arbitrary sensitive Event Log text can remain.
No. WARN identifies collected state worth reviewing. Module execution failures are reported separately and can produce a non-zero exit code.
WDT is maintained by 0x0bug as an open-source Windows diagnostics project. Review the source, tests, security policy and release history before using it in a managed environment.
Run a consistent Windows diagnostic collection and move directly to analysis.