Capafy logo Capafy
Commencer
Windows Infrastructure Health Check

Windows Infrastructure Health Check

by: Gabriel Guimarães
I work daily with Windows infrastructure — Active Directory, GPO, hybrid identity with Entra ID, endpoint hardening (TPM, BitLocker, WDAC), and migration planning for SMB environments. I've built this agent around the same diagnostic workflow I use on real environments: form hypotheses first, ask precise questions, and only prescribe after understanding the actual root cause. No checklists. No generic advice.
#Conseil#Ingénierie#Recherche
Note
Davantage d’évaluations nécessaires
Vendus
0
Mode d’utilisation
Exécuter sur Capafy
Aussi sur des applications externes
Fourni par l’éditeur
Claude Opus 4.8

Windows Infrastructure Health Check

A diagnostic agent for Windows environments — endpoint readiness, Active Directory health, hybrid identity, hardening, and Win10 → Win11 migration. Not a checklist. A senior architect's workflow, automated.

What you get

Endpoint audit — every machine classified as READY, READY WITH ADJUSTMENTS, or NOT ELIGIBLE, with reasoning, blocker analysis, and a prioritized migration sequence.

AD and identity diagnostics — structured triage for GPO failures, replication issues, account lockouts, slow logons, Secure Channel errors, BitLocker recovery requests, and hybrid auth failures. Each problem gets ordered hypotheses and the exact commands to confirm or eliminate them.

Hardening review — TPM 2.0, Secure Boot, BitLocker, VBS, HVCI, WDAC, LAPS, gMSA, Tiered Admin Model, and attack surface reduction (Kerberoasting, Pass-the-Hash, Golden Ticket mitigation).

Migration planning — Win10 → Win11 sequencing, ESU cost and risk exposure, legacy app triage, Autopilot and Intune design, Windows Server lifecycle assessment.

Coverage

DomainKey areasEndpoint readinessTPM 2.0, Secure Boot, CPU generation, disk/RAM/driver gapsActive DirectoryReplication, FSMO, GPO, Sites, DNS, domain trustSecurity and hardeningBitLocker, VBS, HVCI, WDAC, LAPS, gMSA, attack vectorsHybrid identityEntra ID, Hybrid Join, Entra Connect, Conditional Access, MFA, ADFSMigration planningWin10 → Win11, ESU risk, Autopilot, Intune, Windows Server EOLPowerShellInventory scripts, diagnostics, remediation, GPO analysis

How the agent works

Fill in the intake form — machine count, OS mix, domain setup, hardware if known. ~3 minutes.
Agent analyzes your environment and forms a structured diagnosis.
You receive a report with classifications, blockers, and a prioritized action plan.
Ask follow-ups to drill into any finding.

Works with incomplete information — if a layer is a black box on your end, the agent says so and operates on what you can control.

Quick reference — PowerShell commands included

powershell

Get-Tpm | Select TpmPresent, TpmReady, ManufacturerVersion
Confirm-SecureBootUEFI
gpresult /h C:\temp\gpresult.html
repadmin /replsummary
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740}

Who this is for

✅ Infra teams and sysadmins at SMBs planning a Win11 migration or hardware refresh
✅ IT managers troubleshooting AD, GPO, Kerberos, replication, or hybrid identity issues
✅ MSPs and consultants delivering structured assessments to clients
✅ Security engineers reviewing Windows endpoint hardening posture
❌ Large enterprise environments with 500+ endpoints
❌ macOS, Linux, or cloud-only infrastructure

Data and privacy

Model provider: Anthropic (Claude)
No third-party data sharing — all processing stays within Capafy → Anthropic API
No data persistence between sessions

Built by Gaguimar · Infrastructure analyst · Windows and Linux environments


View more