Guide, 2026-11-03

Windows 11 security health check: 14 checks you can run with PowerShell

Whether you look after five PCs at a small office or onboard a new client as an MSP, the first question is always the same: is this machine patched, protected and healthy? Windows has the answers built in — you just have to know where to look. Here are 14 checks you can run from an Administrator PowerShell window, what a good result looks like, and what to do when it isn't.

Before you start

Open Windows PowerShell as Administrator (right-click Start → Terminal (Admin)). Several checks below — BitLocker, Secure Boot and TPM — return errors without elevation. All commands are read-only.

1. When was the last update installed?

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

Good: within the last 35 days (Microsoft ships cumulative updates monthly). Act if: older than 60 days — open Windows Update and find out why it's stuck. Also check the exact build number, which tells you which cumulative update is actually running:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion, CurrentBuild, UBR

2. Is a restart pending?

Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'

Either returning True means installed updates are not active yet. Long uptime ((Get-CimInstance Win32_OperatingSystem).LastBootUpTime) is the usual cause.

3. Is antivirus actually running?

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName, productState

This lists every product registered with Windows Security Center, including third-party ones. If Microsoft Defender is the active product, check real-time protection and signature age:

Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled, AntivirusSignatureAge

Watch out: when another antivirus is installed, Defender reports itself as off — that's expected, not a problem. Check the third-party product instead.

4. Are all three firewall profiles on?

Get-NetFirewallProfile | Select-Object Name, Enabled

Domain, Private and Public should all be True. A disabled Public profile on a laptop is a common finding.

5. Is SMBv1 disabled?

Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

SMBv1 is the protocol abused by WannaCry. It should be False on every modern network.

6. Is User Account Control on?

(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System').EnableLUA

1 means on. 0 means every program runs with full admin rights — fix it.

7. Is Remote Desktop exposed without NLA?

(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication

If the first value is 0, RDP is on. Then the second should be 1 (Network Level Authentication required). Confirm RDP is never reachable directly from the internet.

8. Is automatic logon configured?

(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon').AutoAdminLogon

A value of 1 means anyone who powers on the PC is logged in — and a password may be stored in the registry.

9. Is the Guest account disabled?

Get-LocalUser | Where-Object { $_.SID -like '*-501' } | Select-Object Name, Enabled

10. Who is a local administrator?

Get-LocalGroupMember -SID S-1-5-32-544

Every name here can install software and disable security tools. On domain-joined PCs this can fail when the group contains deleted (orphaned) accounts; net localgroup administrators is a fallback.

11. Is the system drive encrypted?

Get-BitLockerVolume -MountPoint $env:SystemDrive | Select-Object ProtectionStatus, VolumeStatus, EncryptionMethod

Any laptop should show ProtectionStatus: On.

12. Secure Boot and TPM

Confirm-SecureBootUEFI
Get-Tpm | Select-Object TpmPresent, TpmReady

13. Is any drive nearly full?

Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' |
  Select-Object DeviceID, @{n='FreePct';e={[math]::Round($_.FreeSpace/$_.Size*100,1)}}

Below 10% free on the system drive causes failed updates and slow machines.

14. What has been going wrong recently?

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddDays(-7)} |
  Group-Object ProviderName | Sort-Object Count -Descending | Select-Object -First 10 Count, Name

Recurring disk, driver or service-control errors show up here long before users complain.

Turning checks into a report

Running 14 commands by hand works for one PC. For ten, or for a monthly routine, you want the results in one place, scored the same way every time, and comparable across machines. That's the job SysLens was built for.