When you’re investigating a potentially compromised Windows endpoint, the last thing you need is another tool that dumps endless raw output into a console window and calls it “forensics.”

You need the suspicious service that shouldn’t be there. The scheduled task that doesn’t belong. The odd TCP listener waiting for connections. The registry persistence key that explains why malware keeps coming back.

Most importantly, you need all of it in one place.

That’s exactly why I built PSEndpointForensics.

SYSVOL replication failures are one of the domain controller problems that keep IT teams up at night. When SYSVOL stops replicating correctly, Group Policy Objects (GPOs) stop updating, logon scripts fall out of sync, and domain controllers begin serving inconsistent policy data.

It’s important to separate this from Active Directory replication issues:

AD replication (NTDS) handles users, groups, password changes, and directory objects

DFSR (Distributed File System Replication) handles SYSVOL contents like GPO files and scripts

If passwords aren’t replicating, that’s an AD replication problem. If GPOs aren’t applying consistently, that’s usually a SYSVOL/DFSR problem.

This guide focuses on the most common DFS Replication failure scenarios and the safest ways to fix them.

A user reports their workstation keeps going to sleep “on its own.” Or someone claims they never left their desk, yet the session clearly disconnected. Answering these questions means digging through the Windows event log and correlating events across Security and System logs into one timeline.

This script pulls seven distinct event IDs from two different logs, merges them chronologically, and outputs a readable sequence of what happened and when.

Windows Update breaks. Everyone knows this. Stuck update loops, error codes that don’t make sense, a client machine that hasn’t successfully installed patches in months. Microsoft’s official KB article for fixing Windows Update is a wall of 30+ manual steps. You have to stop services, rename folders, reset security descriptors, register DLLs, and restart everything in the correct order.

I wrote a script that does all of it in one shot, and I’ve run it on hundreds of machines with consistent results. Here’s how it works and why each step matters.

External sharing is a compliance nightmare. Your 365 tenant has dozens of SharePoint sites, each with document libraries, and files are shared via links or direct invitations. The SharePoint admin center shows you a high-level sharing policy per site, but it won’t tell you which specific files are shared externally or with whom.

I wrote a script that walks every site, every drive, and every file in your tenant using the Microsoft Graph API, then exports a CSV of every externally shared file with who it’s shared with.