mkdir ClientAssessment_2026
cd ClientAssessment_2026
mkdir Evidence Screenshots Network SystemInfo Passwords Reports
echo Assessment started: %date% %time% > _assessment_log.txt⎘ Copy

New-Item -ItemType Directory -Path "ClientAssessment_2026"
Set-Location "ClientAssessment_2026"
"Evidence","Screenshots","Network","SystemInfo","Passwords","Reports" | ForEach-Object {New-Item -ItemType Directory -Name $_}
"Assessment started: $(Get-Date)" | Out-File "_assessment_log.txt"⎘ Copy

mkdir Evidence_%date:~-4,4%%date:~-10,2%%date:~-7,2%_%time:~0,2%%time:~3,2%⎘ Copy

New-Item -ItemType Directory -Name "Evidence_$(Get-Date -Format 'yyyyMMdd_HHmmss')"⎘ Copy

net user⎘ Copy

Get-LocalUser | Format-Table Name, Enabled, LastLogon, PasswordRequired, PasswordLastSet⎘ Copy

net user Administrator⎘ Copy

Get-LocalUser -Name Administrator | Format-List *⎘ Copy

net localgroup administrators⎘ Copy

Get-LocalGroupMember -Group "Administrators" | Format-Table Name, ObjectClass, PrincipalSource⎘ Copy

whoami /all⎘ Copy

whoami /all⎘ Copy

net localgroup⎘ Copy

Get-LocalGroup | Format-Table Name, Description, SID⎘ Copy

net localgroup "Remote Desktop Users"⎘ Copy

Get-LocalGroupMember -Group "Remote Desktop Users" | Format-Table⎘ Copy

query user⎘ Copy

quser⎘ Copy

query session⎘ Copy

query session⎘ Copy

net accounts⎘ Copy

Get-LocalUser | Select-Object Name, PasswordRequired, PasswordExpires, @{N='PasswordAge(Days)';E={(New-TimeSpan -Start $_.PasswordLastSet).Days}}⎘ Copy

ipconfig /all⎘ Copy

Get-NetIPConfiguration -Detailed⎘ Copy

netsh interface show interface⎘ Copy

Get-NetAdapter | Format-Table Name, InterfaceDescription, Status, LinkSpeed, MacAddress⎘ Copy

arp -a⎘ Copy

Get-NetNeighbor | Format-Table IPAddress, LinkLayerAddress, State⎘ Copy

route print⎘ Copy

Get-NetRoute | Format-Table DestinationPrefix, NextHop, InterfaceAlias, RouteMetric⎘ Copy

netstat -ano⎘ Copy

Get-NetTCPConnection | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess⎘ Copy

netstat -ano | findstr LISTENING⎘ Copy

Get-NetTCPConnection | Where-Object {$_.State -eq "Listen"} | Format-Table LocalAddress, LocalPort, OwningProcess, @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}}⎘ Copy

netstat -ano | findstr ESTABLISHED⎘ Copy

Get-NetTCPConnection | Where-Object {$_.State -eq "Established"} | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}}⎘ Copy

ipconfig /displaydns⎘ Copy

Get-DnsClientCache | Format-Table Entry, Name, Type, TimeToLive⎘ Copy

ipconfig /flushdns⎘ Copy

Clear-DnsClientCache⎘ Copy

net share⎘ Copy

Get-SmbShare | Format-Table Name, Path, Description, CurrentUsers⎘ Copy

net session⎘ Copy

Get-SmbSession | Format-Table ClientComputerName, ClientUserName, NumOpens, SecondsIdle⎘ Copy

ping google.com⎘ Copy

Test-Connection google.com -Count 4⎘ Copy

tracert google.com⎘ Copy

Test-NetConnection google.com -TraceRoute⎘ Copy

nslookup google.com⎘ Copy

Resolve-DnsName google.com⎘ Copy

netstat -s⎘ Copy

Get-NetTCPConnection | Group-Object State | Select-Object Count, Name⎘ Copy

netsh advfirewall show allprofiles⎘ Copy

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction⎘ Copy

netsh advfirewall firewall show rule name=all⎘ Copy

Get-NetFirewallRule | Format-Table DisplayName, Direction, Action, Enabled⎘ Copy

netsh advfirewall firewall show rule name=all | findstr "Rule Name"⎘ Copy

Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True"} | Format-Table DisplayName, Direction, Action⎘ Copy

netsh advfirewall firewall show rule name=all dir=in⎘ Copy

Get-NetFirewallRule | Where-Object {$_.Direction -eq "Inbound" -and $_.Enabled -eq "True"} | Format-Table DisplayName, Action⎘ Copy

netsh advfirewall firewall show rule name=all dir=out⎘ Copy

Get-NetFirewallRule | Where-Object {$_.Direction -eq "Outbound" -and $_.Enabled -eq "True"} | Format-Table DisplayName, Action⎘ Copy

tasklist⎘ Copy

Get-Process | Format-Table ProcessName, Id, CPU, @{N='Memory(MB)';E={[math]::Round($_.WS/1MB,2)}}⎘ Copy

wmic process get name,processid,parentprocessid⎘ Copy

Get-CimInstance Win32_Process | Select-Object ProcessName, ProcessId, ParentProcessId | Format-Table⎘ Copy

wmic process get name,processid,executablepath⎘ Copy

Get-Process | Select-Object ProcessName, Id, Path | Format-Table⎘ Copy

wmic process get name,processid,commandline⎘ Copy

Get-CimInstance Win32_Process | Select-Object Name, ProcessId, CommandLine | Format-Table -Wrap⎘ Copy

wmic process get name,processid,workingsetsize /format:list | sort⎘ Copy

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 | Format-Table ProcessName, Id, CPU, @{N='Memory(MB)';E={[math]::Round($_.WS/1MB,2)}}⎘ Copy

tasklist /fi "memusage gt 100000"⎘ Copy

Get-Process | Sort-Object WS -Descending | Select-Object -First 10 | Format-Table ProcessName, Id, @{N='Memory(MB)';E={[math]::Round($_.WS/1MB,2)}}⎘ Copy

tasklist /svc⎘ Copy

Get-Process | Where-Object {$_.Name -match 'svchost'} | Format-Table ProcessName, Id⎘ Copy

taskkill /F /IM notepad.exe⎘ Copy

Stop-Process -Name notepad -Force⎘ Copy

taskkill /F /PID 1234⎘ Copy

Stop-Process -Id 1234 -Force⎘ Copy

sc query type= service state= all⎘ Copy

Get-Service | Format-Table Name, DisplayName, Status, StartType⎘ Copy

sc query type= service state= running⎘ Copy

Get-Service | Where-Object {$_.Status -eq "Running"} | Format-Table Name, DisplayName⎘ Copy

sc query type= service state= inactive⎘ Copy

Get-Service | Where-Object {$_.Status -eq "Stopped"} | Format-Table Name, DisplayName⎘ Copy

sc qc Spooler⎘ Copy

Get-Service Spooler | Format-List *⎘ Copy

wmic service where StartMode="Auto" get Name,State⎘ Copy

Get-Service | Where-Object {$_.StartType -eq "Automatic"} | Format-Table Name, Status⎘ Copy

for /f "skip=9 tokens=1,2 delims=:" %i in ('netsh wlan show profiles') do @echo %j | findstr -i -v echo | netsh wlan show profiles %j key=clear | findstr "Key Content"⎘ Copy

(netsh wlan show profiles) | Select-String "\:(.+)$" | ForEach-Object {
    $name=$_.Matches.Groups[1].Value.Trim()
    $wifi = (netsh wlan show profile name=$name key=clear)
    $pass = $wifi | Select-String "Key Content\W+\:(.+)$"
    if($pass){
        [PSCustomObject]@{
            SSID=$name
            Password=$pass.Matches.Groups[1].Value.Trim()
        }
    }
} | Format-Table -AutoSize⎘ Copy

powershell Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled⎘ Copy

Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled, BehaviorMonitorEnabled, AntivirusSignatureLastUpdated⎘ Copy

powershell Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess⎘ Copy

Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension⎘ Copy

wevtutil qe Security /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName Security -Newest 20 | Format-Table TimeGenerated, EventID, Message -Wrap⎘ Copy

wevtutil qe Security "/q:*[System[(EventID=4625)]]" /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4625} | Select-Object -First 20 | Format-Table TimeGenerated, Message -Wrap⎘ Copy

wevtutil qe Security "/q:*[System[(EventID=4624)]]" /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName Security | Where-Object {$_.EventID -eq 4624} | Select-Object -First 20 | Format-Table TimeGenerated, Message -Wrap⎘ Copy

reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA⎘ Copy

Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" | Select-Object EnableLUA, ConsentPromptBehaviorAdmin⎘ Copy

net session >nul 2>&1 && echo Administrator || echo Not Administrator⎘ Copy

([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")⎘ Copy

dir /s /b C:\*.txt⎘ Copy

Get-ChildItem -Path C:\ -Recurse -Filter *.txt -ErrorAction SilentlyContinue | Select-Object FullName⎘ Copy

forfiles /S /M * /C "cmd /c if @fsize GTR 104857600 echo @path @fsize"⎘ Copy

Get-ChildItem -Path C:\ -Recurse -File -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 100MB} | Select-Object FullName, @{N='Size(MB)';E={[math]::Round($_.Length/1MB,2)}} | Sort-Object 'Size(MB)' -Descending⎘ Copy

forfiles /P C:\ /S /D -7 /C "cmd /c echo @path @fdate"⎘ Copy

Get-ChildItem -Path C:\ -Recurse -File -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object FullName, LastWriteTime⎘ Copy

dir /s /a:h C:\⎘ Copy

Get-ChildItem -Path C:\ -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$_.Attributes -match "Hidden"} | Select-Object FullName⎘ Copy

findstr /S /I /M "password" C:\*.txt⎘ Copy

Get-ChildItem -Path C:\ -Recurse -Include *.txt -ErrorAction SilentlyContinue | Select-String -Pattern "password" | Select-Object Path, LineNumber, Line⎘ Copy

dir⎘ Copy

Get-ChildItem | Format-Table Name, Length, LastWriteTime⎘ Copy

icacls C:\⎘ Copy

Get-Acl C:\ | Format-List⎘ Copy

systeminfo⎘ Copy

Get-ComputerInfo | Format-List⎘ Copy

systeminfo | findstr /C:"Host Name" /C:"Domain"⎘ Copy

Get-ComputerInfo | Select-Object CsName, CsDomain, CsWorkgroup⎘ Copy

ver⎘ Copy

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer⎘ Copy

wmic qfe list⎘ Copy

Get-HotFix | Format-Table Description, HotFixID, InstalledOn⎘ Copy

wmic cpu get name,numberofcores,maxclockspeed⎘ Copy

Get-CimInstance Win32_Processor | Select-Object Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed⎘ Copy

wmic memorychip get capacity,speed⎘ Copy

Get-CimInstance Win32_PhysicalMemory | Select-Object @{N='Capacity(GB)';E={[math]::Round($_.Capacity/1GB,2)}}, Speed, Manufacturer⎘ Copy

wmic diskdrive get model,size,interfacetype⎘ Copy

Get-CimInstance Win32_DiskDrive | Select-Object Model, @{N='Size(GB)';E={[math]::Round($_.Size/1GB,2)}}, InterfaceType⎘ Copy

wmic logicaldisk get caption,size,freespace⎘ Copy

Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{N='Used(GB)';E={[math]::Round($_.Used/1GB,2)}}, @{N='Free(GB)';E={[math]::Round($_.Free/1GB,2)}}⎘ Copy

wmic bios get serialnumber,version⎘ Copy

Get-CimInstance Win32_BIOS | Select-Object SerialNumber, Version, Manufacturer⎘ Copy

wmic baseboard get product,manufacturer,version,serialnumber⎘ Copy

Get-CimInstance Win32_BaseBoard | Select-Object Manufacturer, Product, Version, SerialNumber⎘ Copy

systeminfo | findstr /C:"System Boot Time"⎘ Copy

Get-CimInstance Win32_OperatingSystem | Select-Object @{N='Uptime';E={(Get-Date) - $_.LastBootUpTime}}, LastBootUpTime⎘ Copy

set⎘ Copy

Get-ChildItem Env: | Format-Table Name, Value⎘ Copy

tzutil /g⎘ Copy

Get-TimeZone⎘ Copy

wmic product get name,version⎘ Copy

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher | Format-Table⎘ Copy

reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /v DisplayName⎘ Copy

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher | Format-Table⎘ Copy

wmic startup list full⎘ Copy

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-Table⎘ Copy

schtasks /query /fo LIST⎘ Copy

Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Select-Object TaskName, State, TaskPath | Format-Table⎘ Copy

wevtutil qe System /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName System -Newest 20 | Format-Table TimeGenerated, EntryType, Source, Message -Wrap⎘ Copy

wevtutil qe Application /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName Application -Newest 20 | Format-Table TimeGenerated, EntryType, Source, Message -Wrap⎘ Copy

wevtutil qe System "/q:*[System[(Level=2)]]" /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName System -EntryType Error -Newest 20 | Format-Table TimeGenerated, Source, Message -Wrap⎘ Copy

wevtutil qe System "/q:*[System[(Level=3)]]" /c:20 /f:text /rd:true⎘ Copy

Get-EventLog -LogName System -EntryType Warning -Newest 20 | Format-Table TimeGenerated, Source, Message -Wrap⎘ Copy

powershell Add-Type -AssemblyName System.Windows.Forms; $screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height); $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.Location, [System.Drawing.Point]::Empty, $screen.Size); $bitmap.Save('screenshot.png'); $graphics.Dispose(); $bitmap.Dispose()⎘ Copy

Add-Type -AssemblyName System.Windows.Forms
$screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
$bitmap = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height)
$graphics = [System.Drawing.Graphics]::FromImage($bitmap)
$graphics.CopyFromScreen($screen.Location, [System.Drawing.Point]::Empty, $screen.Size)
$bitmap.Save("screenshot_$(Get-Date -Format 'yyyyMMdd_HHmmss').png")
$graphics.Dispose()
$bitmap.Dispose()⎘ Copy

powershell Compress-Archive -Path "Evidence" -DestinationPath "Evidence_Archive_%date:~-4,4%%date:~-10,2%%date:~-7,2%.zip"⎘ Copy

Compress-Archive -Path "Evidence" -DestinationPath "Evidence_Archive_$(Get-Date -Format 'yyyyMMdd_HHmmss').zip"⎘ Copy

certutil -hashfile filename.txt MD5⎘ Copy

Get-FileHash -Path filename.txt -Algorithm MD5⎘ Copy

certutil -hashfile filename.txt SHA256⎘ Copy

Get-FileHash -Path filename.txt -Algorithm SHA256⎘ Copy

echo ===== QUICK ASSESSMENT REPORT ===== > quick_report.txt
echo Date: %date% >> quick_report.txt
echo Time: %time% >> quick_report.txt
echo. >> quick_report.txt
systeminfo | findstr /C:"Host Name" /C:"OS Name" /C:"OS Version" >> quick_report.txt
ipconfig | findstr /C:"IPv4" >> quick_report.txt
net user >> quick_report.txt⎘ Copy

@"
===== QUICK ASSESSMENT REPORT =====
Date: $(Get-Date)
Assessor: [Your Name]

$((Get-ComputerInfo | Select-Object CsName, WindowsVersion | Format-List | Out-String))
$((Get-NetIPConfiguration | Select-Object IPv4Address | Format-List | Out-String))
$((Get-LocalUser | Format-Table | Out-String))
"@ | Out-File "quick_report_$(Get-Date -Format 'yyyyMMdd').txt"⎘ Copy

echo ===== FULL SECURITY ASSESSMENT REPORT ===== > full_report.txt
echo Generated: %date% %time% >> full_report.txt
echo. >> full_report.txt
echo [SYSTEM INFORMATION] >> full_report.txt
systeminfo >> full_report.txt
echo. >> full_report.txt
echo [NETWORK CONFIGURATION] >> full_report.txt
ipconfig /all >> full_report.txt
echo. >> full_report.txt
echo [USER ACCOUNTS] >> full_report.txt
net user >> full_report.txt
echo. >> full_report.txt
echo [RUNNING PROCESSES] >> full_report.txt
tasklist >> full_report.txt⎘ Copy

$report = @"
===== FULL SECURITY ASSESSMENT REPORT =====
Generated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
Assessor: [Your Name]

[SYSTEM INFORMATION]
$((Get-ComputerInfo | Format-List | Out-String))

[NETWORK CONFIGURATION]
$((Get-NetIPConfiguration -Detailed | Format-List | Out-String))

[USER ACCOUNTS]
$((Get-LocalUser | Format-Table | Out-String))

[LOCAL GROUPS]
$((Get-LocalGroup | Format-Table | Out-String))

[RUNNING PROCESSES]
$((Get-Process | Format-Table | Out-String))

[SERVICES]
$((Get-Service | Format-Table | Out-String))

[NETWORK CONNECTIONS]
$((Get-NetTCPConnection | Format-Table | Out-String))
"@
$report | Out-File "full_report_$(Get-Date -Format 'yyyyMMdd').txt"⎘ Copy

reg query "HKLM\SECURITY\Cache"⎘ Copy

reg query "HKLM\SECURITY\Cache"⎘ Copy

type %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt⎘ Copy

Get-Content (Get-PSReadLineOption).HistorySavePath⎘ Copy

type "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History"⎘ Copy

# Chrome stores history in SQLite - use external tool to read
Write-Host "Chrome history located at: $env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"⎘ Copy

reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion backup.reg⎘ Copy

reg export HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion backup.reg⎘ Copy

vssadmin list shadows⎘ Copy

Get-CimInstance Win32_ShadowCopy | Select-Object InstallDate, VolumeName, DeviceObject⎘ Copy