Windows Sentinel

Diagnosing a Windows machine that freezes intermittently usually ends in guesswork. A support tool reports twenty problems, most of them irrelevant, and “fixes” them without recording what it changed. When the machine breaks further there is no way back and no record of what happened. Meanwhile the honest answer — this is most likely the display driver, with moderate confidence, and here is the evidence — is never offered.

A toolkit that starts read-only and stays read-only until a repair is explicitly requested. Findings carry evidence, a confidence level, a severity and a rollback plan rather than a verdict. Repairs fall into three tiers, and the most dangerous operations are hard-blocked rather than merely discouraged — the tool will not disable Defender, the firewall, Secure Boot, BitLocker or UAC under any circumstance, and it never uploads logs or telemetry.

• Three-tier repair classification: safe-automatic, requires-approval, and never-automatic
• An evidence engine where every finding carries evidence, confidence, source, recommended action, risk and rollback method
• System inventory and Windows version, build and edition detection with pending-reboot awareness
• Windows Defender status reporting
• Event-log correlation for freeze, black-screen and mouse-symptom investigations, producing ranked hypotheses rather than blame
• Driver problem-device auditing through WMI/CIM
• Storage SMART and reliability counter reporting
• Power-plan and timeout inspection
• A runnable read-only PowerShell diagnostic core that needs no build step and emits HTML, JSON and text reports
• A WPF desktop shell, a SQLite data layer and a parameterised PowerShell execution layer
• Unit tests covering the evidence engine, the safety classifier and the pre-flight guard
• A published privacy document stating that no telemetry is uploaded

• This is an active build, not a finished product. The repository roadmap marks most diagnostic modules as scaffolded or partial, and says so openly.
• No downloadable build exists — both published releases have no attached files, and the desktop application must be compiled on Windows.
• Live vulnerability-intelligence fetching from vendor and government sources is a designed capability with a documented offline fallback; it was not independently verified as working during this audit.
• The repository name is WinVuln while the project itself is called Windows Sentinel.
• No licence file is published.

• C#
• .NET 8
• WPF
• PowerShell
• SQLite
• xUnit