MSP First 5 Minutes Triage (PowerShell)

A read-only PowerShell script that captures the highest-signal endpoint health + posture data to quickly classify common MSP tickets into likely buckets:

• Identity/Auth
• Network/DNS
• Updates/Reboot
• Disk/Performance
• Security Baseline

This is designed for: helpdesk + MSP workflows, where you need fast, consistent triage output you can paste into a ticket or attach from an RMM job.

Why this exists

Most MSP tickets are not “cool incidents.” They are repeatable friction:

• login/MFA confusion
• DNS/connectivity failures
• patch drift / pending reboot
• low disk / slow device
• baseline security hygiene

This script compresses the first ~5 minutes of investigation into a single artifact.

What it collects (high signal)

Host / device

• OS caption/version
• model/manufacturer
• logged-on user
• uptime hours (reboot debt)

Disk / performance

• system drive free/total
• memory utilization %
• CPU load %

Identity (M365-friendly)

• dsregcmd /status key fields (Entra join, domain join, MDM URL where present)

Time sync

• w32tm /query /status summary (time skew breaks sign-in/MFA)

Network

• adapter snapshot (IP/gateway/DNS)
• WinHTTP proxy info
• VPN adapter detection (best-effort)
• DNS + TCP/443 tests to configurable hosts

Updates / reboot blockers

• multiple “pending reboot” indicators
• most recent hotfix

Security baseline

• Defender status (if available)
• Windows Firewall profile enabled/disabled
• BitLocker status for system drive (if available)

Output

The script produces:

1. Structured JSON (default) for:

   • RMM job output capture
   • attaching to tickets
   • later analysis

2. Optional human-readable text summary for quick ticket notes.

It also returns an exit code (best-effort) that can be used by RMM tooling to route tickets.

Usage

Run locally (JSON output)

.\Invoke-MspTriage.ps1