Windows Health Analyser for SCADA Servers (AJ Collector)

Run the read-only AJ Collector on a SCADA server, HMI, historian or engineering workstation — no installation — and open its report here. The analyser explains services, events, boot and logon delays, time, domain, network, listening ports, firewall, accounts, security settings and certificates, compares the computer with a baseline, and makes an anonymised copy to send to support.

Installing diagnostic software on a SCADA server usually needs vendor approval, so the problem waits. A short, readable PowerShell script that only reads settings and logs is far easier to approve. It saves one file; the analysis happens here, in your browser, and the same file can be compared with an earlier one to see exactly what changed.

Standards followed

Windows event, service, firewall and account information as reported by Windows itselfSecurity checks in line with common hardening practice (IEC 62443 system hardening, Microsoft security baselines)Thresholds and rules stated with each finding

What it can do

System: end of support, pending restart, patch age, available memory. Disks: available space, physical health, disk errors.
Services: automatic services not running (with crash history and dependency chain), named service accounts, remote access agents, print spooler on servers.
Events grouped and explained; boot duration, Group Policy and Netlogon delays; time source, stratum, dispersion and clock steps; domain secure channel.
Network findings from ipconfig, route and netstat; listening ports compared with your approved list; firewall profiles and risky rules.
Accounts and a security baseline: built-in Administrator, guest, passwordless and dormant accounts, local admins, password policy, NLA, SMBv1, UAC, USB, AutoRun, LLMNR, antivirus, audit policy. Certificates expiring or weak.
Compare with a baseline report (services, ports, administrators, software, updates, firewall rules, certificates, security settings) and download an anonymised copy.

Example problem

The sample report of SCADA-SRV01, taken after operators complained of slow logon and a historian that keeps stopping.

Historian Service stopped although Automatic: it crashed 5 times (7031) and historian.exe faults in ntdll.dll (1000).
Boot takes 185 s; Group Policy 1129 and Netlogon 5719 at start-up: the domain controller is not reachable when Windows starts.
Security: NLA off on Remote Desktop, SMBv1 on, a remote support agent installed with a firewall rule open to any address, an operator account in Administrators.

Send the historian crash details to the vendor, make the server's switch port an edge port, and raise the security items through the site's change process.

The collector never changes anything and the report is analysed in your browser, never uploaded. Use 'Download anonymised copy' before sending a report to a vendor or support team.

1. Get the AJ Collector 1.0

Download AJ-Collector.ps1 Read the script first ↗

SHA-256: 503C39909F9BA27C34BF65DFD3D176C0B13F44052CBE930DB749FD7E335506EC — check it on the target computer with Get-FileHash .\AJ-Collector.ps1.

Copy the script to the computer through the site's approved transfer process.
Open PowerShell as administrator (for the complete report) in that folder and run:powershell.exe -ExecutionPolicy Bypass -File .\AJ-Collector.ps1“Bypass” applies to this one run only and changes no policy.
It takes about a minute and writes AJCollector_<computer>_<date>.json. Open that file below.

What the collector reads (16 parts) and what it never does

System	Windows version, last boot, hardware, domain or workgroup, installed updates, pending-restart flags
Disks	Volumes and free space; physical disk health
Services	State, start type, account, path and dependencies of every service
Event logs	System and Application errors and warnings of the last 7 days; boots, shutdowns, time changes and service installs; boot duration
Security events	Failed logons, lockouts, account and group changes, log clearing, new services	admin
Time	w32tm /query /status, /configuration and /source; time zone
Network	ipconfig /all, route print, arp -a, netstat -ano, adapters, listening ports with their process
Processes	Name, process ID, memory and CPU time
Windows Firewall	Profiles and enabled rules (ports, addresses, programs)
Accounts	Local users, members of Administrators and Remote Desktop Users, password policy (net accounts)
Security settings	Remote Desktop and NLA, SMBv1, UAC, USB storage, AutoRun, LLMNR, Defender status
Audit policy	auditpol /get /category:*	admin
Domain	Domain controller (nltest /dsgetdc), Group Policy summary (gpresult /r)
Secure channel	Test-ComputerSecureChannel and nltest /sc_verify (read-only tests)	admin
Software	Installed programs: name, version, publisher, install date
Certificates	Computer Personal, Remote Desktop and Web Hosting stores — public data only, never private keys

It never changes a setting, starts or stops a service, installs anything, reads private keys or passwords, or sends anything over the network. Parts that need administrator rights are skipped and listed in the report when run without them. If scripts are blocked on the computer, run the commands from the Command Output Explainer by hand instead.

2. Open the report

Open report (.json)…Baseline to compare…

Approved listening ports (protocol matrix)

Tool guide · know before you use

What this tool is, how it works and how far to trust it

A two-part health check for Windows SCADA computers: the AJ Collector, a readable PowerShell script that only reads settings and logs and writes one file, and this analyser, which explains that file in your browser.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

Report system, patch and disk state; automatic services that are not running, with their crash history and dependency chain; named service accounts and remote access agents.
Group and explain the event log; measure boot duration and find Group Policy and Netlogon delays; judge the time service and clock steps; verify the domain secure channel.
Read ipconfig, route and netstat; compare listening ports with your approved protocol matrix; flag disabled firewall profiles and rules open to any address.
Check local accounts, administrators, password policy and a security baseline (NLA, SMBv1, UAC, USB, AutoRun, LLMNR, antivirus, audit policy); list expiring or weak certificates.
Compare a report with a baseline report of the same computer, and create an anonymised copy for vendors and support teams.

Why you need it

Diagnostic software usually cannot be installed on a SCADA server without vendor approval; a short read-only script that can be read before it runs is much easier to approve.
One report collects in a minute what a support engineer would otherwise ask for piece by piece over days.
A report taken after commissioning becomes the approved baseline; comparing later reports shows unapproved changes immediately.

Understand this first

The collector reads only; it does not repair anything. Fixes are made by people, through the site's change process and within the SCADA vendor's approved configuration.
Run as administrator for a complete report; without it, Security events, audit policy and the secure channel test are skipped and listed as such.
Findings are judged at the time the report was taken. Thresholds and baseline checks are common practice; the site's own standard and the vendor's requirements take precedence.
A report contains names, addresses and accounts: anonymise it before it leaves the site.

What you need before you start

The AJ-Collector.ps1 script (download on this page; check its SHA-256), copied to the computer through the approved transfer process.
Windows PowerShell 5.1 (included in Windows 10/11 and Windows Server 2016 onwards); administrator rights for the complete report.
Optionally an earlier report of the same computer as baseline, and your list of approved listening ports.
A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

Download the script, read it, and check the SHA-256 on the target computer (Get-FileHash).
Run it in PowerShell as administrator: powershell.exe -ExecutionPolicy Bypass -File .\AJ-Collector.ps1 (Bypass applies to that run only).
Open the AJCollector_<computer>_<date>.json file here; enter your approved ports.
Work through Findings (filter by area), then Services, Events, Ports & firewall and Baseline; open a baseline report to see changes.
Use Download anonymised copy before sending the report to anyone.

What you get

Counts by severity, a system summary, findings by area, service and event tables, a listening-port table against the approved list, the security baseline table, a change list against a baseline, and an anonymised JSON copy.

How to read the results

Problems first: stopped critical services, crashing applications, disk errors, broken secure channel, insecure settings.
Checks are risks or deviations from common practice; decide each one against the site's standard and record the decision.
Notes are context (time hierarchy, administrators list, dynamic ports); they explain rather than accuse.
In the comparison, every added administrator, listening port, service or firewall rule should match an approved change.

Technical basis

Data as reported by Windows: CIM/WMI classes, Get-Service, Get-WinEvent, Get-NetTCPConnection, Get-NetFirewall*, Get-LocalUser/Group, registry values, w32tm, nltest, net accounts, auditpol.
Event explanations from the Windows Error & Event Code Explainer; network explanations from the Command Output Explainer.
Rules stated in each finding: available disk space below 15 / 5 %, available memory below 10 %, last update older than 90 days, boot longer than 2 minutes, dormant account older than 90 days, password length below 8, antivirus signatures older than 7 days, certificate expiry within 30 / 90 days, keys below 2048 bits, SHA-1 or MD5 signatures.
End-of-support dates: Windows 7 / Server 2008 R2 2020-01-14, Server 2012 / 2012 R2 2023-10-10, Windows 10 2025-10-14, Server 2016 2027-01-12, Server 2019 2029-01-09.
Anonymisation: host, domain and user names replaced; IPv4 addresses mapped keeping the last octet and /24 relationships; MAC addresses keep the manufacturer prefix.

Limits: when not to rely on it

A snapshot: it does not monitor. Problems that come and go may not appear in a single report; collect during the problem.
Non-English Windows output may reduce what the time, network and event explanations recognise.
It reports configuration, not effectiveness: an enabled antivirus or firewall rule is not proof of protection.
Not a substitute for a security assessment or the vendor's health check.

Sample files for this tool

Download, open and compare with what the guide says you should see.

AJCollector_SAMPLE_SCADA-SRV01.json — AJ Collector report of a SCADA server, with deliberate faults

All sample files and what to expect →

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13