Untitled

# Collect-DefenderAndSystemReport.ps1
# Run this script as Administrator

$ts = Get-Date -Format "yyyyMMdd_HHmmss"
$Computer = $env:COMPUTERNAME
$out = "C:\Temp\DefenderReport_${Computer}_$ts"
New-Item -Path $out -ItemType Directory -Force | Out-Null

# 1) Defender info
Get-MpComputerStatus | Out-File "$out\Get-MpComputerStatus.txt"
Get-MpPreference | Out-File "$out\Get-MpPreference.txt"

# 2) Updates & signatures
Update-MpSignature -Verbose *>&1 | Out-File "$out\Update-MpSignature.txt"

# 3) Threat history
Get-MpThreatDetection | Export-Csv "$out\Get-MpThreatDetection.csv" -NoTypeInformation
Get-MpThreat | Export-Csv "$out\Get-MpThreat.csv" -NoTypeInformation

# 4) Defender operational log
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 1000 | Export-Csv "$out\Defender_Operational_Log.csv" -NoTypeInformation

# 5) System info
Get-CimInstance -ClassName Win32_OperatingSystem | Select Caption,Version,BuildNumber,OSArchitecture,InstallDate | Out-File "$out\OSInfo.txt"
Get-HotFix | Sort-Object InstalledOn -Descending | Export-Csv "$out\HotFixes.csv" -NoTypeInformation

# 6) Installed programs
$keys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
Get-ItemProperty $keys -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | 
    Select-Object DisplayName,DisplayVersion,Publisher,InstallDate | Export-Csv "$out\InstalledPrograms.csv" -NoTypeInformation

    # 7) Processes, startup, tasks
    Get-Process | Sort-Object CPU -Descending | Select-Object -First 200 | Export-Csv "$out\TopProcesses.csv" -NoTypeInformation
    Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run -ErrorAction SilentlyContinue | Export-Csv "$out\Startup_HKLM_Run.csv" -NoTypeInformation
    Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -ErrorAction SilentlyContinue | Export-Csv "$out\Startup_HKCU_Run.csv" -NoTypeInformation
    Get-ScheduledTask | Export-Csv "$out\ScheduledTasks.csv" -NoTypeInformation

    # 8) Network connections
    if (Get-Command Get-NetTCPConnection -ErrorAction SilentlyContinue) {
            Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Export-Csv "$out\NetTCPConnections.csv" -NoTypeInformation
    } else {
            netstat -ano | Out-File "$out\netstat_ano.txt"
    }

    # 9) Disk / volumes
    if (Get-Command Get-Volume -ErrorAction SilentlyContinue) {
            Get-Volume | Select DriveLetter,FileSystemLabel,FileSystem,Size,SizeRemaining | Export-Csv "$out\Volumes.csv" -NoTypeInformation
    } else {
            Get-PSDrive -PSProvider FileSystem | Export-Csv "$out\Drives.csv" -NoTypeInformation
    }

    # 10) Event logs (last 24h)
    $since = (Get-Date).AddDays(-1)
    Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$since} -MaxEvents 2000 | Export-Csv "$out\SystemEvents_Last24h.csv" -NoTypeInformation
    Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$since} -MaxEvents 2000 | Export-Csv "$out\AppEvents_Last24h.csv" -NoTypeInformation

    # 11) Zip the report
    $zip = "$env:TEMP\DefenderReport_${Computer}_$ts.zip"
    Compress-Archive -Path "$out\*" -DestinationPath $zip -Force

    Write-Host "`nReport folder: $out"
    Write-Host "`nZipped report: $zip"
    }
    }
    }
    }