Five tested PowerShell scripts in one archive. Each one came out of real sysadmin work, each one was run and checked before it went in, and each listing below says exactly what it does and what it refuses to do.

All five run on Windows 10 or 11 with PowerShell 5.1. Three of them need no administrator rights at all.

05 TEMP FILE CLEANER

Deletes files older than a threshold from the temp folders, and nothing newer. Runs in a dry-run mode by default so you see what would go before anything goes. Writes a CSV log of what was freed. Refuses to touch the Windows component store, Program Files and other system paths.

Verified on a real machine: found 583 files worth 292 MB in the user temp folder before deleting a single one.

06 LOCAL ADMIN AUDIT

Lists every account in the local administrators group, every account in groups whose name suggests admin rights, and every account that looks like a leftover: service names, disabled accounts created in the last six months, accounts that have never logged in. Read-only. The last category is where backdoor accounts hide.

07 TLS CERTIFICATE EXPIRY MONITOR

Connects to each host and reads the certificate directly off the wire, no external tools and no PowerShell modules required. Tells you how many days remain and colours the result. Handles unreachable hosts instead of stopping at the first one.

Verified against live hosts: github.com, google.com and example.com, plus a deliberately invalid domain to confirm the error path works.

08 SERVICE WATCHDOG WITH RESTART CAP

Checks critical services and restarts the stopped ones, but never more than a set number of times per run. That cap is the whole point: a service that flaps will otherwise be restarted until it takes the machine down with it. Everything it did and refused to do goes into the log.

09 SHARE PERMISSIONS AUDIT

Walks your shares and reports every ACL entry where Everyone, Users or Guests hold FullControl, Modify, Write or Delete. Tells you whether the permission was set explicitly or inherited from a parent, because explicit entries are the ones you can actually fix. Read-only, and it walks into subfolders when you ask it to.

A NOTE ON WHAT THESE SHARE

The same five bugs you hit in any script you did not write yourself came up while building this set, and each one is documented in the archive: a registry path format that reg.exe rejects, a missing byte-order mark that breaks the parser, a variable name differing by grammatical case so a counter silently returned zero, a substring match that found 'crypt' inside the Russian word for 'script', and a connection-name search that failed on localized Windows. Every fix was verified by re-running and comparing the output before and after.

THE ARCHIVE CONTAINS

Five scripts, one sample output per script captured from an actual run, and a license file. If you buy one of these separately it is the same script with an instruction file added.