Windows Infrastructure Health Check
Windows Infrastructure Health Check
A diagnostic agent for Windows environments — endpoint readiness, Active Directory health, hybrid identity, hardening, and Win10 → Win11 migration. Not a checklist. A senior architect's workflow, automated.
What you get
Endpoint audit — every machine classified as READY, READY WITH ADJUSTMENTS, or NOT ELIGIBLE, with reasoning, blocker analysis, and a prioritized migration sequence.
AD and identity diagnostics — structured triage for GPO failures, replication issues, account lockouts, slow logons, Secure Channel errors, BitLocker recovery requests, and hybrid auth failures. Each problem gets ordered hypotheses and the exact commands to confirm or eliminate them.
Hardening review — TPM 2.0, Secure Boot, BitLocker, VBS, HVCI, WDAC, LAPS, gMSA, Tiered Admin Model, and attack surface reduction (Kerberoasting, Pass-the-Hash, Golden Ticket mitigation).
Migration planning — Win10 → Win11 sequencing, ESU cost and risk exposure, legacy app triage, Autopilot and Intune design, Windows Server lifecycle assessment.
Coverage
DomainKey areasEndpoint readinessTPM 2.0, Secure Boot, CPU generation, disk/RAM/driver gapsActive DirectoryReplication, FSMO, GPO, Sites, DNS, domain trustSecurity and hardeningBitLocker, VBS, HVCI, WDAC, LAPS, gMSA, attack vectorsHybrid identityEntra ID, Hybrid Join, Entra Connect, Conditional Access, MFA, ADFSMigration planningWin10 → Win11, ESU risk, Autopilot, Intune, Windows Server EOLPowerShellInventory scripts, diagnostics, remediation, GPO analysis
How the agent works
Fill in the intake form — machine count, OS mix, domain setup, hardware if known. ~3 minutes.
Agent analyzes your environment and forms a structured diagnosis.
You receive a report with classifications, blockers, and a prioritized action plan.
Ask follow-ups to drill into any finding.
Works with incomplete information — if a layer is a black box on your end, the agent says so and operates on what you can control.
Quick reference — PowerShell commands included
powershell
Get-Tpm | Select TpmPresent, TpmReady, ManufacturerVersion
Confirm-SecureBootUEFI
gpresult /h C:\temp\gpresult.html
repadmin /replsummary
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740}
Who this is for
✅ Infra teams and sysadmins at SMBs planning a Win11 migration or hardware refresh
✅ IT managers troubleshooting AD, GPO, Kerberos, replication, or hybrid identity issues
✅ MSPs and consultants delivering structured assessments to clients
✅ Security engineers reviewing Windows endpoint hardening posture
❌ Large enterprise environments with 500+ endpoints
❌ macOS, Linux, or cloud-only infrastructure
Data and privacy
Model provider: Anthropic (Claude)
No third-party data sharing — all processing stays within Capafy → Anthropic API
No data persistence between sessions
Built by Gaguimar · Infrastructure analyst · Windows and Linux environments
