Remote Access
Reviews Remote Desktop and Remote Assistance, then checks installed software and running activity against a remote-access / RMM watchlist.
Windows Security Utility
Threat Inspection
Threat Inspection is a free, read-only Windows 10/11 inspection tool designed to help review common security concerns, suspicious activity, persistence, remote-access software, browser settings, network configuration, and Windows Security. It produces a detailed HTML report for technician or user review.
Overview
What Threat Inspection checks
Threat Inspection combines Windows configuration checks, installed-software context, persistence inspection, signature-aware file review, browser review, network checks, and Microsoft Defender / Windows Security state into one report.
Programs & Startup
Reviews PUP/PUA watchlist matches, installed-software context, and startup persistence while reducing duplicate findings.
Autoruns / Persistence
Uses Microsoft Autorunsc when available, applies signature-aware filtering, and reviews additional persistence such as WMI subscriptions.
Scheduled Tasks / Services / Processes
Checks scheduled tasks, services, drivers, and processes with signature-aware and behavior-focused filtering.
Suspicious Files
Reviews targeted recent files and groups remote-access / PUP artifacts while excluding Threat Inspection's own generated files and known-safe helper scripts.
Browsers
Reviews Chrome, Edge, Brave, Vivaldi, Opera, Opera GX, and Firefox extensions, selected settings, notification origins, and configured browser policies. Automated browser coverage is intentionally partial.
Network
Reviews proxy settings, DNS, VPN and network adapters, hosts-file entries, firewall rules, and attention-worthy network connections.
Windows Security
Inventories antivirus providers and reviews Microsoft Defender protection state, PUA protection, exclusions, security intelligence age, and detection history.
Report Guide
Understanding the five report categories
The dashboard is designed to separate normal inventory from items that deserve attention. A Review or Warning is not automatically a malware verdict.
Info
Inventory or context that helps explain the system without indicating a security problem by itself.
Good
An expected security-state finding, such as a protection feature being enabled or a risky feature being disabled.
Review
A finding that should be verified for legitimacy or expected configuration.
Warning
A stronger risk indicator that deserves closer investigation.
Antivirus
Security Center antivirus-provider inventory. This card identifies registered protection rather than representing a severity level.
Threat Inspection is an inspection aid, not a malware verdict. Legitimate software or configuration choices can appear as Review or Warning findings, so results should be interpreted in context.
Transparency
What the tool does — and does not — change
The inspection itself is designed to observe and report. It does not automatically remediate findings.
It does not
- Delete inspected files
- Disable inspected services or tasks
- Change browser settings
- Disable Microsoft Defender or firewall rules
- Quarantine threats
- Upload files or hashes
Supporting changes used for report navigation
To make Review and Warning findings easier to investigate, Threat Inspection registers a narrow per-user threatinspection:// URL handler under HKCU and stores its helper under LocalAppData. The helper is limited to opening supported local/UNC folders and selected Windows management tools.
Microsoft Autorunsc
If Autorunsc is not already available and downloading is not skipped, the tool can temporarily download it from Microsoft's Sysinternals site, verify that it is Microsoft-signed, use it locally, and remove the temporary download afterward.
Targeted, not antivirus replacement
The suspicious-file review intentionally targets higher-value locations and indicators. Large cache and package directories are skipped to reduce noise, so Threat Inspection should not be treated as a replacement for antivirus scanning.
How It Works
Running an inspection
- Download and extract the Threat Inspection ZIP.
- Run the PowerShell script with administrator permission. The script requires Windows PowerShell 5.1 or newer.
- The inspection reviews the supported Windows security and persistence areas. Recent-file review uses a 30-day window by default.
- An HTML report named Threat Inspection MM-DD-YY.html is written to the current user's Desktop.
- The report opens automatically unless the
-NoOpenReportoption is used. - Review the Info, Good, Review, Warning, and Antivirus sections. Many Review and Warning pills link directly to the relevant Windows setting, management tool, or local folder.
Recent Development
Recent Threat Inspection improvements
v1.22 — Smarter batch-file review
Batch and CMD files are no longer flagged simply because they are unsigned. They are surfaced when filename or content inspection matches stronger malware-style behaviors.
v1.21 — Fewer safe-script false positives
Known-safe Threat Inspection launchers, Microsoft OneDrive log-collection helpers, and GoogleUpdater's uninstall command are treated as Info rather than Review.
v1.20 — Defender exclusions shortcut
Defender exclusion findings can open Windows Security's Add or remove exclusions page directly for faster verification.
v1.19 — Dashboard counts match the report
Info, Good, Review, and Warning totals count the actual finding rows displayed in the report.
v1.18 — Consistent severity colors
Finding pills were aligned with the dashboard: Info blue, Good green, Review yellow, and Warning red.
v1.17 — Five-card security dashboard
The report summary was reorganized into Info, Good, Review, Warning, and Antivirus cards.
FAQ
Frequently asked questions
Does Threat Inspection remove malware?
No. It identifies and organizes findings for review. It does not automatically delete, quarantine, or remediate them.
Does it upload my files?
No. The script does not upload inspected files or file hashes.
Does it require administrator access?
Yes. The PowerShell script declares an administrator requirement so it can inspect the Windows areas needed for the report.
Where is the report saved?
The completed HTML report is saved to the current user's Desktop and normally opens automatically when the inspection completes.
Does a Warning mean the PC is infected?
No. Warning is a stronger risk indicator, but the report is still an inspection aid rather than a malware verdict. Findings should be verified in context.
Is this a replacement for antivirus software?
No. Threat Inspection performs targeted configuration, persistence, and file review. Antivirus software remains the appropriate tool for full real-time and malware scanning.