Tools / Free Tools
Prove one thing clearly, then decide if you need a bigger workflow.
Each free item solves a bounded operator job and should be useful on its own. When several assets cover the same operational problem, start with the item marked Primary workflow; supporting utilities handle narrower collection, parsing, or implementation tasks.
Choose A Starting Point
Browse by the kind of work
01ScriptingReusable PowerShell and command starters for repeatable admin work, quick checks, and practical automation.18 items02ReportingFoundations, helpers, templates, and report-oriented tools for turning raw checks into repeatable operator evidence.11 items03AppsBuilt-in and third-party utilities worth keeping around when the workflow is better served by a purpose-built tool.4 items04Guided DrillsStep-by-step validation drills for backup restores, access checks, readiness checks, and other proof work.14 items
Complete Directory
All free tools
Scripting
Reusable PowerShell and command starters for repeatable admin work, quick checks, and practical automation.
PowerShell server connectivity quick checkA concise read-only connectivity triage script that separates DNS, ICMP reachability, and expected TCP-port failures before escalation.Windows server health snapshotA read-only Windows Server health snapshot that returns one compact row per host for uptime, disk pressure, memory headroom, stopped automatic services, and recent system errors.Pending reboot detection across Windows serversA read-only pending reboot check for Windows servers before patching, application installs, or maintenance-window closure.Certificate expiration scannerA read-only certificate inventory that finds local-machine store certificates nearing expiration and captures certificates presented by known TLS endpoints for review.IIS site and binding inventoryA read-only IIS inventory that correlates sites, bindings, ports, host headers, app-pool identities, content paths, and certificate thumbprints for migration or renewal work.Local administrator group audit across Windows endpointsA read-only local administrator audit that records privileged group membership across Windows endpoints for review.File share permission auditA read-only file share audit that records SMB share permissions, NTFS access, and ownership evidence for review.Windows firewall rule auditA read-only Windows Firewall audit that records enabled allow rules, ports, profiles, and address scopes.DNS resolution and reverse lookup auditA read-only DNS audit that compares forward and reverse lookup results across host lists and expected DNS servers.Installed Application Inventory for Windows EndpointsA read-only PowerShell inventory starter for collecting installed applications from local or remote Windows endpoints.RDP failure triage scriptA read-only RDP triage script pattern for DNS, TCP 3389, listener state, firewall evidence, sessions, and event logs.Robocopy job template and log parserA safer Robocopy job template with dry-run review, log capture, exit-code interpretation, and migration evidence.Robocopy Job TemplateA safer starting point for repeatable Windows file copy jobs with logging and dry-run review.Azure Arc bulk onboarding CSV and logging starterReusable starter for Azure Arc onboarding waves using a host CSV, dry-run expectations, per-host logging, and repeatable result tracking suitable for tickets, change records, and post-wave reporting.Azure Update Manager patch wave planning templateOperator-ready planning template for Azure Update Manager patch waves covering scope, maintenance windows, reboot tolerance, exclusions, soak periods, rollback contacts, and stop-go criteria before scheduled patching.All-DC lastLogon collector and stale-user evidence reportCollect non-replicated lastLogon values from every writable domain controller, calculate the newest observed logon per account, and export evidence suitable for stale-user or stale-computer cleanup decisions without relying on replicated lastLogonTimestamp alone.Authenticated Users drive ACL scannerPowerShell scanner that checks fixed local drives on Windows servers for root ACL entries where Authenticated Users have broad access. Produces console and CSV evidence so admins can review exposure before any ACL changes.Service account usage finderA read-only configuration-discovery pass for service-account assignments in Windows services, scheduled tasks, and IIS application pools, designed as the first step of—not a substitute for—the full retirement evidence workflow.
Reporting
Foundations, helpers, templates, and report-oriented tools for turning raw checks into repeatable operator evidence.
Disk space cleanup candidate reportA read-only disk-pressure report that captures low-space context and returns targeted cleanup candidates from known folders without deleting, compressing, or moving anything.Scheduled task inventory and failure reportA read-only scheduled task inventory that highlights failed runs, missed runs, disabled tasks, and ownership gaps.DHCP scope utilization reportA read-only DHCP scope report that surfaces high utilization, exhausted ranges, and cleanup candidates.AD stale computer cleanup reportA read-only Active Directory stale computer report for last logon, OU, operating system, enabled state, and cleanup planning.Incident Note TemplateA compact operator note format for capturing symptoms, checks, decisions, and follow-up while the issue is fresh.Azure Update Manager compliance workbook starterStarter template for an Azure Workbook plus Resource Graph evidence pack that shows patch compliance, pending updates, unsupported coverage, and patch-group drift across Azure and Arc-enabled machines.RADIUS and NPS server detection reportRead-only PowerShell reporting script pattern to identify likely Microsoft NPS or other RADIUS-capable Windows servers using multiple evidence sources: NPS service presence, NPAS role/feature state, IAS/NPS event log activity, UDP 1812/1813 listener evidence, and registry indicators. Designed for migration discovery, audit support, and authentication troubleshooting.PowerShell operations reporting foundationUse the Ops Reporting Foundation helper to turn PowerShell checks into consistent HTML, CSV, JSON, and log artifacts. Start here after creating the helper file, then plug health checks, patch checks, certificate scans, AD hygiene checks, and other collectors into the same reporting pattern.Build the Ops Reporting Foundation HelperCreate the local PowerShell helper file that every Ops Stack reporting-compatible script can share. This guide walks through the folder structure, the helper contract, the commented PowerShell implementation, a sample validation run, and the artifacts the helper creates so a new reader can build it from scratch and prove it works.PowerShell HTML operations report starterConcrete PowerShell reporting pattern for turning host-check results into an HTML operations summary with a status rollup, per-host table, failure section, saved local artifacts, and optional email delivery.Patch compliance Prove the Number monthly evidence packA ready-to-fill monthly record that turns patch-compliance methodology into a defensible reporting package: population reconciliation, denominator rules, unknown/stale systems, exclusions, applicability, evidence coverage, exceptions, signoff, and management summary.
Apps
Built-in and third-party utilities worth keeping around when the workflow is better served by a purpose-built tool.
Sysinternals first-response kit guideA practical Sysinternals first-response map for process, file handle, startup, network, login, and registry symptoms.Wireshark packet capture triage guideA packet-capture triage guide for DNS, TLS, DHCP, SMB, RDP, retransmissions, and sensitive-data handling.Free network scanner and port inventory guideA practical guide to free network scanning options for host discovery, port inventory, and safe scan scoping.Uptime Kuma Monitoring StarterA simple monitoring starter for internal services, homelab systems, and small-office status checks.
Guided Drills
Step-by-step validation drills for backup restores, access checks, readiness checks, and other proof work.
RDP Connectivity ChecklistA structured check for RDP failures before changing firewall rules, user rights, or server policy.Backup Restore Drill Evidence ChecklistA restore-drill evidence template for proving backups are usable, measuring recovery time, and turning failed assumptions into repair tasks before an outage.Windows Update Repair ChecksA staged Windows Update troubleshooting path that starts read-only and escalates only when needed.Windows Update readiness and repair evidence packA patch readiness and repair evidence pack for reboot state, servicing health, update logs, and approved repair actions.Azure Arc onboarding preflight checklistPreflight checklist for onboarding Windows servers to Azure Arc. Confirms supported OS state, outbound connectivity, proxy/TLS behavior, local admin rights, target Azure placement, tagging, pilot scope, and rollback notes before any agent install.Inactive AD user disable review workflowTwo-phase review checklist for identifying inactive AD user accounts, validating inactivity evidence, applying exclusions, capturing approval, and preparing rollback details before any disable action.Internal IIS site rollout checklistOperator checklist for launching an internal IIS-hosted site with evidence capture for IIS role presence, site folder layout, bindings, app pool identity, DNS readiness, browser validation, and rollback notes.DNS and DHCP Health CheckA read-only two-client DNS failure workflow that collects the same evidence on the affected and known-good Windows clients, compares suffix, resolver, cache, and query paths side by side, and narrows the first actual delta before any reset.SMB working-user vs failing-user access comparisonCompare a working and failing user's identity, token, Kerberos, share ACL, NTFS ACL, inheritance, and effective-access path to identify the first authorization delta before changing permissions.Windows Server update failure evidence-first runbookA Windows Server-specific observe, compare, repair, validate workflow for one server that fails a monthly update while a peer succeeds, with proxy, update-source, servicing, applicability, CBS/DISM, and before/after evidence.Service account retirement evidence workflowCombine configuration discovery with runtime authentication evidence, SPN/Kerberos review, owner approval, an observation window, and explicit DISABLE / HOLD / ROLLBACK criteria before retiring a domain service account.Internal URL monitoring deployment and trust runbookOne authoritative path for monitoring 10–20 internal HTTP/HTTPS endpoints: define endpoint semantics, deploy Uptime Kuma, set retry and maintenance policy, add TLS/auth checks, alert, retain history, and prove the monitor with a controlled outage.Primary workflow: Robocopy migration cutover evidence packThe primary production file-migration workflow: plan, dry-run, pre-seed, freeze writes, final delta, validate data/metadata/access, and make an explicit GO / STOP / ROLLBACK decision before the destination becomes authoritative.Backup restore drill evidence recordA ready-to-fill restore-test record with scope, isolated restore evidence, application/data validation, measured RPO/RTO, failures, assumptions, cleanup, owner signoff, and a management/change summary.
Disclosure: Some future recommendations may use affiliate links where available. Recommendations should stay practical, clearly labeled, and tied to operator use cases.