system-diagnostics

Windows System Diagnostics

Comprehensive Windows 11 system diagnostics using PowerShell. This skill helps diagnose crashes, freezes, unexpected reboots, disk problems, memory issues, hardware errors, and performance bottlenecks.

Table of Contents

• Quick Start - Immediate diagnostic commands
• Platform Requirements - Windows 11, PowerShell 7+
• Diagnostic Categories - What this skill covers
• Quick Health Check - Fast system overview
• Reference Loading - Progressive disclosure
• Safety Model - Read-only vs suggested repairs
• Common Issues - Troubleshooting patterns

Overview

This skill provides read-only diagnostic capabilities to gather system health information. It does NOT execute repair commands - those are provided as suggestions for the user to run manually.

Capabilities:

• Event log analysis (crashes, errors, warnings)
• Disk health monitoring (SMART data, filesystem errors)
• Memory diagnostics (usage, leaks, hardware issues)
• Hardware error detection (device failures, drivers, WHEA)
• Performance analysis (CPU, memory, disk bottlenecks)
• System stability metrics (uptime, restart reasons)

When to Use This Skill

Use this skill when:

• Computer is crashing, freezing, or rebooting unexpectedly
• Blue Screen of Death (BSOD) errors occur
• Disk health concerns (slow performance, errors)
• Memory issues suspected (high usage, crashes under load)
• Hardware errors or driver problems
• Need to analyze Windows Event Viewer logs
• System performance degradation
• Investigating application crashes

Platform Requirements

Required:

• Windows 11 (this skill is optimized for Windows 11 Pro)
• PowerShell 7+ (pwsh) for best compatibility

Verify PowerShell version:

$PSVersionTable.PSVersion

Note: Most commands also work with Windows PowerShell 5.1, but PowerShell 7+ is recommended for consistent behavior.

Quick Start

Immediate System Health Check

Run these commands to get a quick overview of system health:

# System info and uptime
Get-Uptime
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, CsProcessors, CsTotalPhysicalMemory

# Recent critical/error events (last 7 days)
Get-WinEvent -FilterHashtable @{LogName='System';Level=1,2;StartTime=(Get-Date).AddDays(-7)} -MaxEvents 20 |
    Select-Object TimeCreated, Id, ProviderName, Message | Format-Table -Wrap

# Disk health
Get-PhysicalDisk | Select-Object FriendlyName, MediaType, Size, HealthStatus, OperationalStatus

# Top memory consumers
Get-Process | Sort-Object WorkingSet64 -Descending |
    Select-Object -First 10 ProcessName, Id, @{N='MB';E={[math]::Round($_.WorkingSet64/1MB,0)}}

# Device errors
Get-PnpDevice -PresentOnly | Where-Object { $_.Status -in 'Error','Degraded','Unknown' } |
    Select-Object Class, FriendlyName, Status

Diagnostic Categories

Category	Description	Reference
Event Logs	Windows Event Viewer analysis	event-logs.md
Disk Health	SMART data, filesystem, storage	disk-health.md
Memory	RAM usage, leaks, hardware	memory-diagnostics.md
Stability	Uptime, restarts, BSOD	system-stability.md
Hardware	Device errors, WHEA, drivers	hardware-errors.md
Performance	CPU, memory, disk bottlenecks	performance-analysis.md
Crashes	Minidumps, WER, BSOD analysis	crash-analysis.md
Elevation	Admin requirements, graceful degradation	admin-elevation.md

Quick Health Check

System Information

# Basic system info
Get-ComputerInfo | Select-Object `
    OsName, OsVersion, OsBuildNumber, `
    CsName, CsDomain, `
    CsProcessors, CsNumberOfLogicalProcessors, `
    @{N='RAM_GB';E={[math]::Round($_.CsTotalPhysicalMemory/1GB,1)}}

# System uptime
Get-Uptime
Get-Uptime -Since  # Last boot time

Recent System Errors

# Critical and Error events from System log (last 7 days)
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Level = 1,2  # 1=Critical, 2=Error
    StartTime = (Get-Date).AddDays(-7)
} -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message

Disk Quick Check

# Physical disk health
Get-PhysicalDisk | Select-Object FriendlyName, MediaType, Size, HealthStatus, OperationalStatus

# SMART-like reliability data
Get-PhysicalDisk | ForEach-Object {
    $disk = $_
    $counters = $_ | Get-StorageReliabilityCounter
    [PSCustomObject]@{
        Disk = $disk.FriendlyName
        Health = $disk.HealthStatus
        Temperature = $counters.Temperature
        ReadErrors = $counters.ReadErrorsTotal
        WriteErrors = $counters.WriteErrorsTotal
        PowerOnHours = $counters.PowerOnHours
    }
}

Memory Quick Check

# System memory overview
Get-CimInstance Win32_OperatingSystem | Select-Object `
    @{N='Total_GB';E={[math]::Round($_.TotalVisibleMemorySize/1MB,2)}},
    @{N='Free_GB';E={[math]::Round($_.FreePhysicalMemory/1MB,2)}},
    @{N='Used_Pct';E={[math]::Round((1 - $_.FreePhysicalMemory/$_.TotalVisibleMemorySize)*100,1)}}

# Top 10 memory-consuming processes
Get-Process | Sort-Object WorkingSet64 -Descending |
    Select-Object -First 10 ProcessName, Id,
        @{N='WS_MB';E={[math]::Round($_.WorkingSet64/1MB,0)}},
        @{N='PM_MB';E={[math]::Round($_.PrivateMemorySize64/1MB,0)}}

Hardware Quick Check

# Devices with errors
Get-PnpDevice -PresentOnly | Where-Object { $_.Status -in 'Error','Degraded','Unknown' } |
    Select-Object Class, FriendlyName, InstanceId, Status

# WHEA hardware errors (last 30 days)
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    ProviderName = 'Microsoft-Windows-WHEA-Logger'
    StartTime = (Get-Date).AddDays(-30)
} -MaxEvents 20 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, Message

Reference Loading Guide

References are loaded on-demand based on the diagnostic category being investigated. This progressive disclosure keeps token usage efficient.

Always Load (Core)

The main SKILL.md provides quick commands for initial triage (~4k tokens).

Conditional Load

Load specific references based on what you're investigating:

Trigger	Reference to Load
Event logs, errors, warnings	event-logs.md
Disk, storage, SMART, chkdsk	disk-health.md
Memory, RAM, paging, leaks	memory-diagnostics.md
Uptime, restarts, reliability	system-stability.md
Hardware, drivers, WHEA, devices	hardware-errors.md
CPU, performance, bottlenecks	performance-analysis.md
BSOD, minidump, crashes, WER	crash-analysis.md
Admin, elevation, permissions	admin-elevation.md

Token Estimates

• Quick health check: ~4k tokens (SKILL.md only)
• Single category deep dive: ~7k tokens (SKILL.md + 1 reference)
• Full diagnostic: ~25k tokens (SKILL.md + all references)

Safety Model

This skill follows a read-only diagnostics model. All commands executed by the skill only gather information - they do not modify the system.

Read-Only (Skill Can Execute)

These commands are safe to run:

Category	Commands
Event Logs	Get-WinEvent
Disk Health	Get-PhysicalDisk, Get-StorageReliabilityCounter, Get-Volume
Memory	Get-Process, Get-CimInstance Win32_OperatingSystem
Devices	Get-PnpDevice
Performance	Get-Counter
System Info	Get-Uptime, Get-ComputerInfo

Suggested Only (User Runs Manually)

These repair/diagnostic commands modify the system or require reboot. The skill will provide instructions but NOT execute them:

Command	Purpose	Notes
chkdsk /f /r	Disk repair	Requires reboot for system drive
sfc /scannow	System file repair	Requires admin
DISM /Online /Cleanup-Image /RestoreHealth	System image repair	Requires admin, internet
mdsched.exe	Memory diagnostic	Requires reboot
Repair-Volume -SpotFix	Quick disk repair	Requires admin
Driver reinstall	Fix driver issues	Manual process

Elevation Notes

Some read-only operations require administrator privileges:

• Get-WinEvent -LogName Security (Security log)
• Repair-Volume -Scan (even read-only scan)
• Some WMI queries

The skill will note when elevation is needed and provide graceful degradation for non-admin scenarios.

Common Diagnostic Scenarios

Scenario: Computer Keeps Crashing/Rebooting

1. Check uptime and recent restart events
2. Look for Kernel-Power Event ID 41 (unexpected shutdown)
3. Check for BSOD minidumps
4. Review hardware errors (WHEA)
5. Check disk and memory health

Key commands:

# Recent restart events
Get-WinEvent -FilterHashtable @{LogName='System';Id=41,1074,6008} -MaxEvents 20

# BSOD events
Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 10

# Check for minidumps
Get-ChildItem C:\Windows\Minidump -ErrorAction SilentlyContinue

Scenario: Slow Performance

1. Check CPU/memory/disk utilization
2. Identify resource-hungry processes
3. Check for disk health issues
4. Look for hardware throttling

Key commands:

# Current resource usage
Get-Counter -Counter '\Processor(_Total)\% Processor Time','\Memory\% Committed Bytes In Use','\PhysicalDisk(_Total)\% Disk Time'

# Top CPU consumers
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 ProcessName, CPU, @{N='MB';E={[math]::Round($_.WorkingSet64/1MB)}}

Scenario: Disk Errors Suspected

1. Check physical disk health status
2. Review SMART reliability counters
3. Look for disk-related events
4. Check filesystem dirty bit

Key commands:

# Disk health
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus

# Reliability counters
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, Temperature, ReadErrorsTotal, WriteErrorsTotal

# Recent disk events
Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='disk','ntfs'} -MaxEvents 20

Scenario: Memory Issues

1. Check current memory usage
2. Identify memory-hungry processes
3. Look for memory-related events
4. Check for previous memory diagnostic results

Key commands:

# Memory usage
Get-CimInstance Win32_OperatingSystem | Select-Object @{N='Used%';E={[math]::Round((1-$_.FreePhysicalMemory/$_.TotalVisibleMemorySize)*100,1)}}

# Top memory processes
Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10 ProcessName, @{N='MB';E={[math]::Round($_.WorkingSet64/1MB)}}

# Memory diagnostic results
Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='Microsoft-Windows-MemoryDiagnostics-Results'} -ErrorAction SilentlyContinue

Anti-Patterns

Do NOT:

• Execute repair commands (chkdsk /f, sfc /scannow, etc.) - only suggest them
• Run commands that require reboot (mdsched.exe) without explicit user consent
• Assume admin privileges are available
• Ignore elevation errors - report them and suggest running as admin
• Make hardware recommendations without diagnostic evidence

Do:

• Start with quick health checks before deep dives
• Load references progressively based on investigation needs
• Report findings with severity (Critical, Warning, Info)
• Provide actionable next steps for the user
• Explain what each suggested repair command does

Version History

• v1.0.0 (2025-12-03): Initial release with Windows 11 diagnostics

Last Updated

Date: 2025-12-03 Model: claude-opus-4-5-20251101