v1.9.64 — Account audit, service dependencies & error handling

Author: TheAbider

Changelog.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v1.9.64
+
+- **New Feature:** Local Account Audit — scans all local user accounts and displays password age, last login, password expiry status, and enabled/disabled state. Flags accounts with passwords older than 365 days, expired passwords, and accounts with no login activity in 90+ days. Accessible from Security & Access > option [8] (22-Password, 48-MenuDisplay, 49-MenuRunner).
+- **New Feature:** Service Dependency Viewer — shows the full dependency tree for any service in Service Manager. Displays both "depends on" (required services) and "depended on by" (dependent services) with live status indicators. Accessible via option [D] in Service Manager (30-ServiceManager).
+- **Bug Fix:** VM RAM validation pre-check uses `-ErrorAction Stop` on `Get-VM` — previously, `-ErrorAction SilentlyContinue` inside a `try/catch` made the catch block unreachable dead code, meaning Hyper-V failures would silently produce an empty VM list instead of being caught (44-VMDeployment).
+- **Bug Fix:** Batch config Defender exclusion idempotency check uses `-ErrorAction Stop` on `Get-MpPreference` — previously, `-ErrorAction SilentlyContinue` prevented error detection when Windows Defender is unavailable or the module fails to load (50-EntryPoint).
+- **Bug Fix:** HTML report NIC statistics collection uses `-ErrorAction Stop` on `Get-NetAdapterStatistics` — previously, `-ErrorAction SilentlyContinue` inside `try/catch` swallowed all errors silently, producing a report with missing NIC data and no indication of the failure (54-HTMLReports).
+- **Bug Fix:** Storage backend auto-detection uses `-ErrorAction Stop` on `Get-ClusterS2D` and `Get-ClusterResource` in 3 locations — previously, `-ErrorAction SilentlyContinue` defeated the `try/catch` error handling, making it impossible to distinguish "cmdlet not available" from "S2D/SMB3 not configured" (59-StorageBackends).
+- 63 modules, 1854 tests
+
 ## v1.9.63
 
 - **New Feature:** Server readiness dashboard now includes a certificate expiration check — scans `LocalMachine\My` store for expired and soon-to-expire certificates (within 30 days), reports count and soonest expiry date, and counts toward the readiness score (37-HealthCheck).

Header.ps1

@@ -30,11 +30,20 @@
     7h3 4b1d3r
 
 .VERSION
-    1.9.63
+    1.9.64
 
 .LAST UPDATED
     03/03/2026
 
+.CHANGELOG v1.9.64
+    ACCOUNT AUDIT, DEPENDENCIES & ERROR HANDLING:
+    - NEW: Local Account Audit — scans all local users showing password age, last login, expiry status, and flags stale/expired accounts (Security & Access menu option 8)
+    - NEW: Service Dependency Viewer — shows full dependency tree (depends on + depended on by) for any service in Service Manager (option D)
+    - FIX: VM RAM validation uses -ErrorAction Stop on Get-VM — previously, SilentlyContinue inside try/catch made the catch block unreachable dead code
+    - FIX: Batch config Defender exclusion check uses -ErrorAction Stop on Get-MpPreference — previously, SilentlyContinue prevented error detection when Defender is unavailable
+    - FIX: HTML report NIC statistics uses -ErrorAction Stop — previously, SilentlyContinue inside try/catch swallowed errors silently
+    - FIX: Storage backend auto-detection uses -ErrorAction Stop on Get-ClusterS2D and Get-ClusterResource — 3 instances where SilentlyContinue defeated try/catch error handling
+
 .CHANGELOG v1.9.63
     CERTIFICATE CHECKS, READINESS & SAFETY:
     - NEW: Server readiness dashboard now checks for expired and soon-to-expire SSL/TLS certificates in LocalMachine\My store

Modules/00-Initialization.ps1

@@ -135,7 +135,7 @@ if (-not $script:ModuleRoot) { $script:ModuleRoot = $PSScriptRoot }
 if (-not $script:ModuleRoot -and $script:ScriptPath) {
     $script:ModuleRoot = [System.IO.Path]::GetDirectoryName($script:ScriptPath)
 }
-$script:ScriptVersion = "1.9.63"
+$script:ScriptVersion = "1.9.64"
 $script:ScriptStartTime = Get-Date
 
 # OS version detection (for feature compatibility)

Modules/22-Password.ps1

@@ -162,4 +162,98 @@ function Get-SecurePassword {
     Write-OutputColor "Maximum attempts reached." -color "Critical"
     return $null
 }
+# Function to audit local user accounts for password and login status
+function Show-LocalAccountAudit {
+    Clear-Host
+    Write-OutputColor "" -color "Info"
+    Write-OutputColor "  ╔════════════════════════════════════════════════════════════════════════╗" -color "Info"
+    Write-OutputColor "  ║$(("                     LOCAL ACCOUNT AUDIT").PadRight(72))║" -color "Info"
+    Write-OutputColor "  ╚════════════════════════════════════════════════════════════════════════╝" -color "Info"
+    Write-OutputColor "" -color "Info"
+
+    try {
+        $users = @(Get-LocalUser -ErrorAction Stop)
+    }
+    catch {
+        Write-OutputColor "  Error retrieving local accounts: $_" -color "Error"
+        return
+    }
+
+    if ($users.Count -eq 0) {
+        Write-OutputColor "  No local user accounts found." -color "Warning"
+        return
+    }
+
+    $now = Get-Date
+    $issues = 0
+
+    Write-OutputColor "  ┌────────────────────────────────────────────────────────────────────────┐" -color "Info"
+    $acctHeader = "  LOCAL USER ACCOUNTS ($($users.Count))"
+    Write-OutputColor "  │$($acctHeader.PadRight(72))│" -color "Info"
+    Write-OutputColor "  ├────────────────────────────────────────────────────────────────────────┤" -color "Info"
+
+    foreach ($user in ($users | Sort-Object Name)) {
+        $enabled = $user.Enabled
+        $statusTag = if ($enabled) { "Enabled " } else { "Disabled" }
+
+        # Password age
+        $pwdAge = if ($null -ne $user.PasswordLastSet) {
+            $days = [math]::Floor(($now - $user.PasswordLastSet).TotalDays)
+            "${days}d ago"
+        } else { "Never set" }
+
+        # Last logon
+        $lastLogon = if ($null -ne $user.LastLogon) {
+            $logonDays = [math]::Floor(($now - $user.LastLogon).TotalDays)
+            if ($logonDays -eq 0) { "Today" } else { "${logonDays}d ago" }
+        } else { "Never" }
+
+        # Password expiry
+        $pwdExpires = if ($user.PasswordNeverExpires) {
+            "Never"
+        } elseif ($null -ne $user.PasswordLastSet) {
+            try {
+                $maxPwdAge = (Get-LocalUser $user.Name -ErrorAction SilentlyContinue).PasswordExpires
+                if ($null -ne $maxPwdAge) {
+                    $expiryDays = [math]::Floor(($maxPwdAge - $now).TotalDays)
+                    if ($expiryDays -lt 0) { "EXPIRED" } else { "${expiryDays}d" }
+                } else { "N/A" }
+            } catch { "N/A" }
+        } else { "N/A" }
+
+        # Determine color based on issues
+        $color = "Success"
+        $flags = @()
+        if (-not $enabled) { $color = "Info" }
+        if ($null -ne $user.PasswordLastSet) {
+            $pwdDays = [math]::Floor(($now - $user.PasswordLastSet).TotalDays)
+            if ($pwdDays -gt 365) { $color = "Error"; $flags += "OLD PWD"; $issues++ }
+            elseif ($pwdDays -gt 90) { $color = "Warning"; $flags += "AGING" }
+        }
+        if ($pwdExpires -eq "EXPIRED") { $color = "Error"; $flags += "EXPIRED"; $issues++ }
+        if ($lastLogon -eq "Never" -and $enabled) { $flags += "NO LOGIN" }
+        if ($null -ne $user.LastLogon) {
+            $logonDays = [math]::Floor(($now - $user.LastLogon).TotalDays)
+            if ($logonDays -gt 90 -and $enabled) { $flags += "STALE"; $issues++ }
+        }
+
+        $flagStr = if ($flags.Count -gt 0) { " [" + ($flags -join ", ") + "]" } else { "" }
+        $nameStr = $user.Name
+        if ($nameStr.Length -gt 20) { $nameStr = $nameStr.Substring(0, 17) + "..." }
+        $line = "  $($statusTag) $($nameStr.PadRight(20)) Pwd: $($pwdAge.PadRight(10)) Login: $($lastLogon.PadRight(8))$flagStr"
+        if ($line.Length -gt 72) { $line = $line.Substring(0, 72) }
+        Write-OutputColor "  │$($line.PadRight(72))│" -color $color
+    }
+    Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
+
+    # Summary
+    Write-OutputColor "" -color "Info"
+    if ($issues -gt 0) {
+        Write-OutputColor "  $issues issue(s) found — review flagged accounts above." -color "Warning"
+    } else {
+        Write-OutputColor "  All accounts look healthy." -color "Success"
+    }
+
+    Add-SessionChange -Category "Security" -Description "Ran local account audit ($($users.Count) accounts, $issues issues)"
+}
 #endregion

Modules/30-ServiceManager.ps1

@@ -77,6 +77,7 @@ function Show-ServiceManager {
         Write-MenuItem -Text "[R]  Restart a Service (enter number)"
         Write-MenuItem -Text "[C]  Change Startup Type (enter number)"
         Write-MenuItem -Text "[A]  Search All Services"
+        Write-MenuItem -Text "[D]  View Service Dependencies"
         Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
         Write-OutputColor "" -color "Info"
         Write-OutputColor "  [B] ◄ Back" -color "Info"
@@ -202,6 +203,51 @@ function Show-ServiceManager {
                     }
                 }
             }
+            "^[Dd]$" {
+                $num = Read-Host "  Enter service number to view dependencies"
+                if ($num -match '^\d+$' -and [int]$num -ge 1 -and [int]$num -le $serviceList.Count) {
+                    $svc = $serviceList[[int]$num - 1]
+                    Write-OutputColor "" -color "Info"
+                    Write-OutputColor "  ┌────────────────────────────────────────────────────────────────────────┐" -color "Info"
+                    $treeHeader = "  DEPENDENCY TREE: $($svc.DisplayName)"
+                    Write-OutputColor "  │$($treeHeader.PadRight(72))│" -color "Info"
+                    Write-OutputColor "  ├────────────────────────────────────────────────────────────────────────┤" -color "Info"
+
+                    # Services this one depends on (required by)
+                    $requires = @(Get-Service -Name $svc.Name -RequiredServices -ErrorAction SilentlyContinue)
+                    if ($requires.Count -gt 0) {
+                        $reqHeader = "  DEPENDS ON ($($requires.Count)):"
+                        Write-OutputColor "  │$($reqHeader.PadRight(72))│" -color "Info"
+                        foreach ($req in $requires) {
+                            $reqColor = if ($req.Status -eq "Running") { "Success" } else { "Warning" }
+                            $reqLine = "    $($req.DisplayName) ($($req.Name)) - $($req.Status)"
+                            if ($reqLine.Length -gt 70) { $reqLine = $reqLine.Substring(0, 67) + "..." }
+                            Write-OutputColor "  │$($reqLine.PadRight(72))│" -color $reqColor
+                        }
+                    } else {
+                        Write-OutputColor "  │$("  DEPENDS ON: (none)".PadRight(72))│" -color "Info"
+                    }
+
+                    Write-OutputColor "  │$(' '.PadRight(72))│" -color "Info"
+
+                    # Services that depend on this one
+                    $dependents = @(Get-Service -Name $svc.Name -DependentServices -ErrorAction SilentlyContinue)
+                    if ($dependents.Count -gt 0) {
+                        $depHeader = "  DEPENDED ON BY ($($dependents.Count)):"
+                        Write-OutputColor "  │$($depHeader.PadRight(72))│" -color "Info"
+                        foreach ($dep in $dependents) {
+                            $depColor = if ($dep.Status -eq "Running") { "Success" } else { "Warning" }
+                            $depLine = "    $($dep.DisplayName) ($($dep.Name)) - $($dep.Status)"
+                            if ($depLine.Length -gt 70) { $depLine = $depLine.Substring(0, 67) + "..." }
+                            Write-OutputColor "  │$($depLine.PadRight(72))│" -color $depColor
+                        }
+                    } else {
+                        Write-OutputColor "  │$("  DEPENDED ON BY: (none)".PadRight(72))│" -color "Info"
+                    }
+
+                    Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
+                }
+            }
             "^[Bb]$" { return }
         }
 

Modules/44-VMDeployment.ps1

@@ -2990,7 +2990,7 @@ function Test-VMDeploymentPreFlight {
         if ($vm.MemoryGB) { $requiredRAMGB += $vm.MemoryGB }
     }
     $runningVMs = @()
-    try { $runningVMs = @(Get-VM -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Running" }) } catch {}
+    try { $runningVMs = @(Get-VM -ErrorAction Stop | Where-Object { $_.State -eq "Running" }) } catch { $runningVMs = @() }
     $existingRAMGB = 0
     foreach ($rv in $runningVMs) { $existingRAMGB += [math]::Round($rv.MemoryAssigned / 1GB, 1) }
     $ramStatus = if (($requiredRAMGB + $existingRAMGB) -gt ($totalRAMGB * 0.95)) { "FAIL" }

Modules/48-MenuDisplay.ps1

@@ -384,6 +384,7 @@ function Show-SecurityAccessMenu {
     Write-OutputColor "  ├────────────────────────────────────────────────────────────────────────┤" -color "Info"
     Write-MenuItem "[6]  Add Local Admin Account"
     Write-MenuItem "[7]  Disable Built-in Admin" -Status $adminDisplay -StatusColor $adminColor
+    Write-MenuItem "[8]  Local Account Audit"
     Write-OutputColor "  └────────────────────────────────────────────────────────────────────────┘" -color "Info"
     Write-OutputColor "" -color "Info"
     Write-OutputColor "  [B] ◄ Back to Server Config" -color "Info"

Modules/49-MenuRunner.ps1

@@ -238,9 +238,10 @@ function Start-Show-SecurityAccessMenu {
             "5" { Set-DefenderExclusions; Write-PressEnter }
             "6" { Add-LocalAdminAccount; Write-PressEnter }
             "7" { Disable-BuiltInAdminAccount; Write-PressEnter }
+            "8" { Show-LocalAccountAudit; Write-PressEnter }
             "back" { return }
             default {
-                Write-OutputColor "Invalid choice. Please enter 1-7 or B." -color "Error"
+                Write-OutputColor "Invalid choice. Please enter 1-8 or B." -color "Error"
                 Start-Sleep -Seconds 2
             }
         }

Modules/50-EntryPoint.ps1

@@ -1297,7 +1297,7 @@ function Start-BatchMode {
     if ($Config.ConfigureDefenderExclusions -and $configType -eq "HOST") {
         # Idempotency: check if exclusion paths are already configured
         $currentExclusions = @()
-        try { $currentExclusions = @((Get-MpPreference -ErrorAction SilentlyContinue).ExclusionPath) } catch {}
+        try { $currentExclusions = @((Get-MpPreference -ErrorAction Stop).ExclusionPath) } catch { $currentExclusions = @() }
         $allPaths = @($script:DefenderExclusionPaths) + @($script:DefenderCommonVMPaths) | Where-Object { $_ }
         $missingPaths = @($allPaths | Where-Object { $_ -notin $currentExclusions })
 

Modules/54-HTMLReports.ps1

@@ -743,11 +743,11 @@ function Save-PerformanceSnapshot {
         # Network bytes
         $netInfo = @()
         try {
-            $netStats = Get-NetAdapterStatistics -ErrorAction SilentlyContinue
+            $netStats = Get-NetAdapterStatistics -ErrorAction Stop
             foreach ($ns in $netStats) {
                 $netInfo += @{ Name = $ns.Name; BytesSent = $ns.SentBytes; BytesReceived = $ns.ReceivedBytes; InErrors = $ns.InErrors; OutErrors = $ns.OutErrors }
             }
-        } catch {}
+        } catch { $netInfo = @() }
 
         $snapshot = [ordered]@{
             Hostname = $hostname