[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'SilentlyContinue'

function Section($title) {
    Write-Host ''
    Write-Host ('=' * 6) $title ('=' * 6) -ForegroundColor Cyan
}

Section 'Computer'
Get-ComputerInfo -Property CsName,CsDomain,CsManufacturer,CsModel,
    WindowsProductName,OsVersion,OsBuildNumber,OsArchitecture,OsInstallDate,
    CsNumberOfProcessors,CsNumberOfLogicalProcessors,OsTotalVisibleMemorySize,
    CsUserName,TimeZone | Format-List

Section 'Boot Time'
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Section 'Local Users'
Get-LocalUser | Select-Object Name,Enabled,LastLogon,Description | Format-Table -AutoSize

Section 'Administrators Group'
Get-LocalGroupMember -Group Administrators |
    Select-Object Name,ObjectClass,PrincipalSource | Format-Table -AutoSize

Section 'Disks'
Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,
    @{n='Size(GB)';e={[math]::Round($_.Size / 1GB, 1)}},
    @{n='Free(GB)';e={[math]::Round($_.SizeRemaining / 1GB, 1)}} |
    Format-Table -AutoSize

Section 'IPv4 Addresses'
Get-NetIPAddress -AddressFamily IPv4 |
    Where-Object { $_.InterfaceAlias -notmatch 'Loopback' } |
    Select-Object InterfaceAlias,IPAddress,PrefixLength | Format-Table -AutoSize

Section 'Listening TCP Ports'
Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress,LocalPort,OwningProcess |
    Sort-Object LocalPort -Unique | Format-Table -AutoSize

Section 'Firewall Profiles'
Get-NetFirewallProfile |
    Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction |
    Format-Table -AutoSize

Section 'SMB Shares'
Get-SmbShare | Select-Object Name,Path,Description | Format-Table -AutoSize

Section 'Defender'
Get-MpComputerStatus |
    Select-Object AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,
        AMEngineVersion,AntivirusSignatureLastUpdated | Format-List

Section 'Installed Apps (non-Microsoft)'
$uninstallPaths = @(
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty $uninstallPaths |
    Where-Object { $_.DisplayName -and $_.Publisher -notmatch 'Microsoft' } |
    Select-Object DisplayName,DisplayVersion,Publisher,InstallDate |
    Sort-Object DisplayName | Format-Table -AutoSize

Section 'Startup Commands'
Get-CimInstance Win32_StartupCommand |
    Select-Object Name,Command,Location,User | Format-Table -AutoSize

Section 'Scheduled Tasks (non-Microsoft, enabled)'
Get-ScheduledTask |
    Where-Object { $_.State -ne 'Disabled' -and $_.TaskPath -notlike '\Microsoft\*' } |
    Select-Object TaskPath,TaskName,State | Format-Table -AutoSize

Section 'SSH Services'
Get-Service sshd,ssh-agent | Format-Table Name,Status,StartType -AutoSize

Section 'Recent Logons (Security 4624, last 48h)'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddHours(-48)} -MaxEvents 50 |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        $d = @{}
        $xml.Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
        [pscustomobject]@{
            Time      = $_.TimeCreated
            LogonType = $d['LogonType']
            User      = "$($d['TargetDomainName'])\$($d['TargetUserName'])"
            IP        = $d['IpAddress']
            Process   = $d['ProcessName']
        }
    } |
    Where-Object { $_.User -notmatch 'SYSTEM|ANONYMOUS|LOCAL SERVICE|NETWORK SERVICE|DWM-|UMFD-|\$$' } |
    Format-Table -AutoSize