KillerBench is a Windows diagnostic and repair workbench for technicians. It checks a computer first, explains what it found with the evidence behind each finding, and only changes Windows when you pick a specific fix and confirm it.

KillerBench is in development. There is no public download yet. These pages describe the current build.

What it does

• Runs read-only diagnostics across Windows Update, devices, storage, networking, printing, security, apps and profiles, then writes a readable report.
• Offers guarded repairs that run only when fresh evidence proves the exact problem, and verifies the result afterwards.
• Covers setup and hardening work such as BitLocker, privacy settings, decluttering Windows and onboarding a new computer.
• Runs diagnostics and report analysis locally without AI or a KillerBench account. Selected actions, such as downloads and recovery-key backup to Entra ID, can contact external services.
• Uses the active app theme for the console, reports, confirmations, and Open, Save, and Folder dialogs.

Where to start

• Download and setup
• About KillerBench

• Your first diagnosis walks through a full system scan.
• The workspace explains the sections, panels and shortcuts.
• How changes stay safe explains what KillerBench checks before and after any change.
• How-to guides walk through common jobs step by step.
• The Sections pages describe every tool, grouped the same way as the app.
• Command line lists every killerbench-cli command.
• Troubleshooting covers blocked actions, restarts and interrupted requests.

Developers who want to embed the diagnostics in their own tools can read the Engine developer guide.

KillerBench 1.0.0 is Unreleased. No public KillerBench package or download is available yet. This page describes the current package requirements so you can prepare without downloading an unofficial copy.

Windows and runtime

• The current publish target is Windows x64. Windows 11 x64 is the current native validation baseline. Native ARM64, x86 and Windows Server distributions are not provided.
• KillerBench is packaged two ways. The installer is framework-dependent and requires .NET Desktop Runtime 10 for Windows x64. The plain .NET Runtime, ASP.NET Core Runtime and .NET Framework do not supply WPF. The portable edition carries its own runtime and needs no separate install. The command-line tool killerbench-cli.exe needs the .NET 10 Runtime for Windows x64. An SDK is needed for development, not for ordinary use.
• Use a Windows version supported by .NET 10 on Windows. Runtime support is not a claim that KillerBench repairs are validated on every supported edition or build. Windows 10 coverage remains pending and its supported editions are limited by Microsoft's current lifecycle requirements.
• Obtain the Desktop Runtime only from Microsoft's .NET 10 download page, choosing .NET Desktop Runtime, Windows, x64. Follow your organization's software-installation rules.

If dotnet is available, dotnet --list-runtimes should list Microsoft.WindowsDesktop.App 10.0.x for the x64 installation. A runtime installed only for another architecture does not satisfy the x64 installer package.

When a package is published

1. Use the official download linked from this website. No KillerBench download link is active yet.
2. Read that package's requirements, GPLv3 license, Corresponding Source instructions, included third-party notices, signature and checksum information. A filename alone does not establish authenticity.
3. Run the installer for the current account, or for all users after an elevation prompt. It adds a Start menu shortcut, an optional desktop shortcut and an Add or Remove Programs entry. The portable edition runs without installation.
4. Start KillerBench as your normal account and follow Your first diagnosis. Diagnostic access failures stay visible; elevation is a separate deliberate choice.

Do not bypass Windows security warnings to run an unverified copy. Keep a current backup before selecting any action that changes the machine.

At startup KillerBench checks GitHub for a newer stable release and asks before installing it. The download must match the published SHA-256 checksum. Turn the check off with Check for updates on startup in About.

Current limits

The current build has twelve sections, read-only diagnosis, reports and individually selected repair surfaces. Native repair validation is still in progress. A working UI, successful build or fixture result does not establish repair behavior on a real computer. See How changes stay safe.

The illustrative console on the landing page is synthetic output. The first public package is still pending.

Source, license and support

KillerBench is licensed under GPLv3. Source-delivery instructions and third-party font permissions remain pending for the first public package. Read About KillerBench for source availability, distribution notices, evidence privacy and support information. The Engine guide is for developers with an authorized source checkout; it does not imply that a public Engine package is available.

Start with Download and setup, then run a Full system scan. It collects diagnostic evidence and saves a local journal; it does not run repairs. A finding describes the inspected scope, not every possible fault on the computer.

Run the scan

1. Open KillerBench. The Diagnostics section opens with Full system scan selected.
2. Leave Auto-repair confirmed issues turned off for your first run.
3. Press Run diagnosis. Progress appears in Raw output on the right while each check runs.
4. When it finishes, the output pane switches to the Readable report.

Start without elevation. Some Windows evidence, such as BitLocker protectors and protected services, needs administrator rights. Those checks report unavailable evidence under a standard account. If you need that evidence, finish the current run, keep the report, then deliberately reopen KillerBench with Run as administrator. Elevation does not select or approve a repair.

Read the report

The report starts with counts for Needs review, Verified repairs, Incomplete and Checked, then a recommended next step.

• What needs attention lists problems the evidence supports, most important first.
• Collected information shows what was read, including evidence that was incomplete or unavailable.
• Historical events are labeled as history. An error from last month is not treated as a current fault.

Missing evidence never counts as healthy. If a check could not run, the report says so.

Choose checks yourself

Open Choose checks (advanced) to pick individual checks instead of the full scan. Each section in the app also has focused tools, described in the Sections pages of this guide.

Fix what you found

When the report recommends a fix, it names the section and tool to open. Read How changes stay safe before your first repair. Native validation is still in progress; a successful diagnosis does not establish that every offered repair has been tested on your Windows build. Keep backups and review the exact target and consequences before any change.

The KillerBench window has three panes that follow the way you work: pick a section on the left, set the tool's options in the center, and read the output on the right. An activity log can open under the options.

Sections

The sidebar on the left lists every tool in twelve sections: Diagnostics, Repair, Updates, Devices, Network, Apps, Maintenance, Onboarding, Security, BitLocker, Privacy and Storage. Drag its edge to resize it, or drag it past its minimum width to snap it closed.

Tool options

The center pane shows the selected section, its tool list and the options for the chosen tool. Options that could change the machine are always off by default. Press Run diagnosis to start the tool. When Auto-repair confirmed issues is turned on, the same button reads Run repair. Stop ends the run after the current command finishes.

Output

The output pane on the right has two views.

• Raw output shows the technical evidence as it is collected, with original line numbers. It opens on its own while a tool runs.
• Readable report shows the finished report for the last run. It replaces the raw output when the run finishes.

Use the filter box in Raw output to show only matching lines. Export report saves the report with its source paths and evidence excerpts. Session sources lists every piece of evidence gathered in this session.

Activity log

The activity log under the tool options records what KillerBench did in this session.

Themes, languages and shortcuts

The rail between the sidebar and the tool options holds the theme picker, the language picker, the shortcut list and the activity log toggle. KillerBench has 13 themes and 20 languages.

The smoked-glass console and readable reports follow the active theme. Confirmations and Open, Save, and Folder dialogs use the same family styling, including the 98SE theme. Choose the theme before opening a dialog to use that appearance throughout the workflow.

Key	Action
F1	Keyboard shortcuts
F2	Show or hide the sidebar
F3	Show or hide the activity log
Alt+Shift+G	Film Grain
F12	About KillerBench
Ctrl+O	Open evidence
Esc	Close an overlay or stop reading a file

KillerBench treats diagnosis and change as different jobs. Diagnosis only reads. The full system scan never runs repairs. Select a specific repair or action, review its options and prerequisites, and confirm the proposed change.

Before a change

1. Fresh evidence. The tool reads the current state again. A saved report or an old event never authorizes a change.
2. Exact eligibility. The change is offered only when the evidence matches the exact problem it fixes. Anything incomplete blocks it.
3. Your confirmation. Review the selected action in its confirmation dialog. Some actions, such as decrypting a drive, need a second confirmation. The dialog follows the active app theme; its appearance does not change the action's requirements.
4. Prerequisites. Administrator rights, restart state and ownership by policy or device management are checked. Settings that a policy owns are left alone.
5. A pending record. KillerBench writes down what it is about to do before it asks Windows to do it.
6. A final recheck. Everything is checked again immediately before the request, so a change in the meantime stops it.

After a change

• KillerBench reads the result back and reports Verified only when Windows shows the expected state.
• If Windows returns success but the state did not change, the result says so and nothing is repeated.
• Each change is saved in a journal under %LOCALAPPDATA%\KillerBench.

If something is interrupted

Supported journaled actions retain a pending record when a request may have reached Windows and verification has not completed. Use the action's documented reconciliation path, or its matching -recover command, to inspect that record. Reconciliation is not an automatic rollback. Keep the journal when an outcome is uncertain, and do not manually repeat the change. Crash, cancellation and later-boot behavior still need action-specific native validation.

What KillerBench will not do

• Clear a TPM, delete protectors it did not create, or display recovery passwords.
• Change a setting that group policy or device management controls.
• Run a repair just because a historical event or imported report mentions a problem.

Diagnostics and report analysis run locally. An action you select can contact an external destination, including software downloads or recovery-key backup to Active Directory or Entra ID. Review the target before confirming. Saved captures and raw evidence can include machine identity and source paths, so review them before sharing.

Development status

Repair coverage is still expanding. A successful build or simulated check does not establish native repair behavior.

Use this when updates fail, stall or keep reinstalling. KillerBench reads the update chain first, explains the failure with the evidence behind it, and only starts a service or repairs the component store when fresh evidence proves that exact problem.

Before you start

• Run KillerBench as administrator. Update services, the component store and protected system files need elevation for complete evidence.
• Restart first if Windows already has a restart pending. Many update repairs are blocked until restart readiness is clear.
• Keep the computer on AC power for servicing work.

Find out why updates fail

1. Open Updates and choose Windows Update in the tool sidebar.
2. Leave Auto-repair confirmed issues off for the first pass and press Run diagnosis.
3. Read the Readable report. It lists stopped update services, pending restarts, low free space, component-store corruption and the exact error codes Windows recorded, with a recommended next step.
4. If the report names an error code, the matching follow-up checks run automatically. You can also look one up yourself with killerbench-cli update-code 0x80070002.

Watch an update that seems stuck

Choose Servicing activity monitor in Updates and press Run diagnosis. It takes repeated snapshots of update, Setup and Installer activity, transfer totals and restart indicators. Activity is shown as evidence only; it never claims a stall or a fault on its own.

Repair what the report found

1. Run Windows Update again with Auto-repair confirmed issues turned on. It can start enabled update services that are confirmed stopped, and it runs DISM or SFC only when the live check confirms corruption.
2. For a single service, choose its focused tool instead, such as BITS service, Cryptographic Services, Windows Modules Installer or Update Orchestrator Service. Each one offers recovery only for that exact service.
3. When the report says to restart, restart before running anything else. KillerBench records restart-required outcomes and defers later work until the restart is done.

Every repair is journaled and read back. See How changes stay safe for the full sequence.

Install a specific update

1. Choose Available updates in Updates and press Run diagnosis to discover updates from the configured source.
2. Select the updates you want and press Preview selected. The preview lists exactly what would install and any restart requirement.
3. Read the preview, tick the confirmation checkbox, then press Install. The checkbox clears after each run, and KillerBench never selects or approves an update for you.

From the command line

killerbench-cli update-search
killerbench-cli update-history
killerbench-cli servicing-monitor --samples 10
killerbench-cli update-plan --select GUID:REVISION --execute

See update-search, update-history, servicing-monitor and update-plan. If an install was interrupted, run update-recover; it checks the outcome and never retries the update.

Related

• Updates section
• Repair system files
• Troubleshooting

Use this when Windows components are corrupted: features fail to install, updates report component errors, or system tools crash. KillerBench runs DISM and SFC only after a live check confirms corruption, then verifies the result.

Before you start

• Run KillerBench as administrator.
• Clear any pending restart first.
• If the machine is managed, check whether policy points DISM at a specific repair source. KillerBench reports that policy and does not change it.

Check for corruption

1. Open Repair and choose System files.
2. Leave Auto-repair confirmed issues off and press Run diagnosis.
3. Read the report. It inventories servicing package, optional-feature and capability states, checks prerequisites and scans protected system files. A clean result means no repair is offered.

Repair confirmed corruption

1. Turn on Auto-repair confirmed issues and press Run repair. KillerBench chooses DISM or SFC only when the live check confirms corruption.
2. Wait for verification. The report shows Verified only when the follow-up check reads back a repaired state.
3. If the report says the store is unrecoverable or the repair source is unavailable, stop there. Repeating the repair will not change the outcome.

An interrupted DISM or SFC run is reconciled on the next boot without repeating the servicing command.

Clean up the component store

Choose Component-store cleanup in Updates. It first asks Windows whether cleanup is recommended. Optional maintenance removes superseded components and analyzes again. It never uses ResetBase and never deletes WinSxS content by hand.

From the command line

killerbench-cli component-repair-source
killerbench-cli repair dism
killerbench-cli repair sfc --execute
killerbench-cli servicing-logs

See component-repair-source, repair and servicing-logs. repair previews by default and acts only with --execute.

Related

• Fix Windows Update
• Repair section
• How changes stay safe

Use this when a drive is running low. KillerBench shows where space is going, previews what each cleanup target would remove, and deletes only after you turn on permanent cleanup.

See how much space is left

1. Open Storage and choose Storage.
2. Press Run diagnosis. The report flags every drive-letter volume under 10% free space and shows shadow-copy allocation, quota defaults and Storage Sense policy.
3. For crash dumps and old update content, also run Vitals in Diagnostics and Windows Update in Updates; the update cache size appears there.

Preview a cleanup

1. Open Maintenance and choose Cleanup.
2. Tick the targets you want, such as Current user temporary files, Windows temporary files, Current user browser caches, Delivery Optimization cache or Current user Recycle Bin. Hover a target to read exactly which folders it covers.
3. Set Minimum age (days) and Maximum files per target.
4. Press Run diagnosis with Perform the selected permanent cleanup after fresh checks turned off. The report lists candidates and estimated space for each target. Nothing is deleted.

Remove the files

1. Turn on Perform the selected permanent cleanup after fresh checks and press Run diagnosis.
2. KillerBench rechecks every candidate before removing it, skips files that are recent, protected or in use, and records each outcome in the journal.

Permanent cleanup bypasses the Recycle Bin and cannot be undone. Removing error reports and crash dumps discards evidence you may need to investigate crashes, so review those first.

Remove the previous Windows installation

After a feature upgrade, Previous Windows installation in Cleanup can remove the rollback copy through the supported Windows rollback-removal request. It runs by itself, needs I backed up any files and settings I need from the previous installation, and permanently removes the ability to go back to the earlier version.

From the command line

killerbench-cli volume-capacity C:
killerbench-cli cleanup --user-temp --windows-temp --days 7 --max-files 500
killerbench-cli cleanup --user-temp --windows-temp --days 7 --max-files 500 --execute

See volume-capacity, cleanup and previous-windows.

Related

• Maintenance section
• Storage section
• Check and repair a drive

Use this when a volume reports errors, Windows asks to scan a drive, or files fail to open. KillerBench checks the volume read-only first and only schedules or runs a filesystem repair after you confirm a backup.

Before you start

• Back up important data on the volume. A filesystem repair can change or remove damaged files.
• Run KillerBench as administrator.

Check the volume

1. Open Storage and choose Storage.
2. Pick the drive in Volume to check and press Run diagnosis.
3. Read the report. It shows disk and volume health, the dirty bit, online NTFS self-healing, controller and disk device errors, reliability counters and recent storage events such as resets, retries and unexpected removal.

A clean check means no repair is offered. Disk temperature, wear and uncorrected I/O counters are review evidence and do not trigger a repair by themselves.

Repair the filesystem

1. Press Review filesystem repair and choose Spot repair or Offline scan and repair.
2. For a data volume, tick Allow a non-system volume to go offline if you can close everything that uses it. The Windows volume cannot go offline, so its repair is scheduled for the next restart instead.
3. Tick Important data on this volume is backed up.
4. Confirm the repair. KillerBench rechecks the exact volume immediately before it acts and records a pending entry first.
5. For a scheduled repair, restart when convenient. KillerBench verifies the result after the restart without running the repair again.

Optimize or retrim

The same tool can analyze the volume and run the Windows-recommended optimization, Retrim solid-state storage or a hard-disk defragmentation. Each is a separate confirmed action on one exact healthy volume.

From the command line

killerbench-cli storage-check C
killerbench-cli storage-repair-plan D: OfflineScanAndFix --allow-dismount
killerbench-cli storage-repair D: OfflineScanAndFix --allow-dismount --backup-confirmed --execute
killerbench-cli storage-repair-recover

See storage-check, storage-repair-plan, storage-repair and volume-optimize.

Related

• Storage section
• Free up disk space
• Troubleshooting

Use this when a computer has no internet, cannot reach a server or name, or keeps dropping its connection. KillerBench checks the adapter, address, gateway, DNS and firewall in order, and only renews a lease or starts a service when fresh evidence proves it is needed.

Check the connection

1. Open Network and choose Network.
2. To test something specific, fill in Hostname lookup (optional), or TCP destination (optional) and TCP port. Leave them blank to check only the local configuration. No application data is sent.
3. Set Timeout per lookup or connection (seconds) if the network is slow.
4. Leave Auto-repair confirmed issues off and press Run diagnosis.
5. Read the report. It separates a missing address, a missing or unreachable gateway, DNS configuration problems, proxy settings, firewall profile mismatches and a failed lookup or connection, and gives the next step for each.

A reply from the gateway does not prove internet access, and a failed lookup through your configured resolver does not mean the site is down.

Repair what the report found

1. Run Network again with Auto-repair confirmed issues turned on. It can start enabled DNS Client, DHCP Client, SMB client, Network Location Awareness, Network List and IP Helper services, and renew connected physical DHCP adapters that lack a usable IPv4 address.
2. Expect the connection to drop briefly during a renewal. Static addresses and virtual adapters are never changed.
3. For one bad cached name, use the DNS cache flush for that exact host instead of clearing everything.

Routes, Hosts entries, DNS servers, firewall rules, Winsock providers and network profiles are always preserved.

Wireless, wired sign-in and proxies

• Wireless networking checks the adapter and WLAN AutoConfig, and can start the service if it is stopped.
• Wired authentication (802.1X) does the same for Wired AutoConfig on networks that need sign-in at the port.
• WinHTTP Auto-Proxy shows stored proxy settings for the machine and the current account. KillerBench never fetches a PAC URL or changes proxy settings during diagnosis.

From the command line

killerbench-cli workflow network --host example.com --tcp example.com 443
killerbench-cli dns-check example.com --timeout-seconds 5
killerbench-cli tcp-check fileserver 445
killerbench-cli dhcp-renew
killerbench-cli dns-cache example.com --execute

See workflow, dns-check, tcp-check, dhcp-renew and dns-cache.

Related

• Network section
• Fix printing problems
• How changes stay safe

Use this when jobs sit in the queue, a printer shows offline, or the wrong printer is the default. KillerBench reads the spooler, queues, jobs, drivers and ports first, then lets you fix one exact queue or job.

Check the printers

1. Open Devices and choose Printing.
2. Press Find local printers and pick the queue that is misbehaving. To check every queue, choose Use general printing checks.
3. Leave Auto-repair confirmed issues off and press Run diagnosis.
4. Read the report. It shows the Print Spooler state, paused queues, offline mode, visible jobs, driver conditions, port registrations, recent PrintService errors and, for network printers, one connection attempt to the printer's assigned address.

A successful connection or a clean condition code does not prove the printer has paper, toner or a working mechanism.

Repair the queue

1. Run Printing again with Auto-repair confirmed issues turned on. It can start the enabled spooler, resume an exact paused queue that has jobs waiting, and clear offline mode.
2. Clearing offline mode can release waiting jobs, so make sure those jobs should still print.
3. A queue someone paused on purpose with nothing waiting stays paused.

Clear one stuck job

1. Press Find blocked print jobs.
2. Select the job that shows Error or Blocked and tick Cancel only this selected job.
3. Press Run diagnosis. Only that job is canceled, and the result is read back.

Fix the default printer

Choose the queue that should be the default and tick Repair a missing or conflicting default with this queue, then press Run diagnosis. This only acts when the default is missing or conflicting.

From the command line

killerbench-cli printer-list
killerbench-cli printer-check --queue "Office Laser"
killerbench-cli printer-repair --queue "Office Laser" --execute
killerbench-cli print-job-list
killerbench-cli print-job-cancel "Office Laser" 12 --execute

See printer-list, printer-check, printer-repair, print-job-cancel and default-printer-set.

Related

• Devices section
• Fix network and internet problems

Use this to turn on BitLocker, back up the recovery key and confirm the drive is protected. KillerBench backs up and verifies the recovery password before it starts encryption, and it never shows or logs a recovery password.

Before you start

• Run KillerBench as administrator.
• The Windows drive needs a TPM protector and a recovery password protector. A data drive needs only a recovery password.
• Decide where the recovery key backup goes: a file outside the drive you are encrypting, and optionally Active Directory or Microsoft Entra ID.

Check the drive

1. Open BitLocker and choose the drive in Volume.
2. Leave the operation on Inspect and press Run diagnosis. The report shows encryption state, protection status and protector identities.
3. If the TPM is present but not ready, prepare it from Security first. KillerBench never clears a TPM.

Add the protectors you need

1. Open More BitLocker actions.
2. Choose Add a TPM protector or Add a recovery password, press Preview, tick Make this change on the selected drive when I press Run action, then press Run action.
3. Back up a new recovery password straight away. KillerBench does not display it.

Back up the recovery key and encrypt

1. Press Find recovery protectors and select the recovery password protector.
2. Enter a full backup file path outside the drive you are encrypting.
3. Choose Encrypt, pick the encryption method, and tick Back up the selected recovery key, then start encryption when I select Run diagnosis.
4. Press Run diagnosis. KillerBench writes the backup, verifies it, then starts encryption once.
5. Encryption continues in the background. Run Inspect later to confirm the drive reports fully encrypted with protection on.

Back up to Active Directory or Entra ID

In More BitLocker actions, choose the directory backup for the selected protector. KillerBench reports that Windows accepted the request but cannot read the directory copy, so confirm it in Active Directory or the Entra admin center.

Data drives and auto-unlock

After a data drive is encrypted, Turn on auto-unlock makes it unlock when Windows starts. The Windows drive must already be fully encrypted with protection on.

From the command line

killerbench-cli bitlocker-protectors C:
killerbench-cli bitlocker-protector-add C: recovery --execute
killerbench-cli bitlocker-encrypt C: RECOVERY_PROTECTOR_GUID D:\Keys\C-recovery.txt --execute
killerbench-cli bitlocker-escrow C: RECOVERY_PROTECTOR_GUID entra --execute

See bitlocker-protectors, bitlocker-protector-add, bitlocker-encrypt and bitlocker-escrow. Each has a matching -recover command for an interrupted request.

Related

• BitLocker section
• Security section
• How changes stay safe

Use this when Windows restarts unexpectedly, shows a stop error, or an application keeps crashing. KillerBench gathers crash, shutdown, hardware-error and reliability evidence into one report. It describes what was recorded and never guesses a root cause.

Check the computer

1. Open Diagnostics and choose Vitals.
2. Press Run diagnosis. The report combines memory, disk health, device problems, Reliability Monitor history, hardware-error records, crash reports, unexpected shutdowns and Windows Memory Diagnostic results.
3. Read the conclusion and the evidence under it. Historical crashes explain what happened; they do not prove a fault is still present.

Narrow it down

• Hardware error history reads WHEA and memory diagnostic records together with device problems and disk health.
• Reliability history groups the last 14 days of application crashes, hangs and unexpected shutdowns.
• Application errors focuses on crashing programs.
• Driver installation history shows failed driver installs matched to devices that are present now.
• Device problems lists devices with Device Manager error codes.

Read crash dumps

KillerBench lists dump configuration and dump-file metadata and can analyze minidump structure for the exception and module names. Dump contents are never opened in the desktop app. With a bug-check knowledge pack loaded, stop codes resolve to their documented meaning.

Keep the dumps until you finish investigating. Cleanup can remove them, but that discards the evidence.

From the command line

killerbench-cli vitals-check
killerbench-cli crash-config
killerbench-cli crash-dumps
killerbench-cli crash-review
killerbench-cli device-code 43

See vitals-check, crash-review and device-code.

Related

• Diagnostics section
• Reports and evidence

Use this to review and tighten privacy on a laptop. KillerBench reads the current settings, shows which ones policy or device management already own, and changes only the settings you pick, one at a time, with an exact undo.

Review the current settings

1. Open Privacy.
2. Tick the areas you want to review. Every area starts unchecked.
3. Press Run diagnosis. The report shows the current value for this machine and the account running KillerBench, and flags settings owned by policy.

Change a setting

1. Choose the setting in Privacy setting, such as camera, microphone, location, diagnostic data, advertising, clipboard history, cloud content search or search highlights.
2. Choose the new value and tick Apply when I select Run diagnosis.
3. Press Run diagnosis. KillerBench checks for a policy owner, records the current value, makes the one change and reads it back.

Settings owned by group policy or device management are left alone. Change those where they are managed.

Undo a change

Each verified change keeps a journal. The matching undo restores the exact previous value, again after a policy check.

Declutter Windows

For suggestions, consumer content, Recall and AI features, taskbar and Start clutter, Edge and preinstalled software, open Maintenance and choose Declutter Windows. The review is read-only and nothing is selected automatically.

From the command line

killerbench-cli privacy-plan --select Camera --select ClipboardSync
killerbench-cli privacy-setting camera-access off --execute
killerbench-cli privacy-setting-undo camera-access VERIFIED_JOURNAL --execute
killerbench-cli debloat-review --area TelemetryAndReporting

See privacy-plan, privacy-setting, privacy-setting-undo and debloat-review. An unsupported key lists the supported choices.

Related

• Privacy section
• Set up a new computer

Use this when preparing a new or freshly reset PC. KillerBench reviews the computer, the applications you plan to install and the name you want to give it, then points to the guarded tools that make each change.

Start with a baseline

1. Run Full system scan from Diagnostics and keep the report as a record of the computer's starting state.
2. Install pending updates. See Fix Windows Update if any fail.

Review applications and configuration

1. Open Onboarding and choose Onboarding.
2. Select the applications and configuration groups you plan to set up and press Run diagnosis. The review compares them with what is already installed. KillerBench does not download or run installers.
3. Before running a vendor installer, verify it from the command line. KillerBench trusts it only when it carries a valid signature from that vendor's exact organization name.

Name the computer

1. Choose Computer name, enter the name and press Run diagnosis to review it against the current identity and domain role.
2. On a workgroup computer, tick Rename this workgroup PC after fresh checks to rename it. A restart is needed to finish.

Protect and tidy it

• Encrypt a drive with BitLocker and back up the recovery key.
• Make Windows more private and review Declutter Windows in Maintenance.
• Create a restore point with Prepare one restore point once everything is in place.

From the command line

killerbench-cli depot-verify-installer chrome C:\Installers\ChromeSetup.exe
killerbench-cli workflow computer-name --name FRONTDESK-01
killerbench-cli restore-point "Baseline after setup" --execute

See workflow and restore-point.

Related

• Onboarding section
• Your first diagnosis

Use the command line when you want KillerBench evidence in a script, an RMM job or a remote console. killerbench-cli runs the same Engine as the desktop app and prints JSON.

Get started

1. Open PowerShell where killerbench-cli.exe is, or add its folder to your path.
2. Run killerbench-cli help to list every command with its safety boundary.
3. Run killerbench-cli diagnostic-scopes to see the 11 recommended diagnostic groups.

Run a scan and save a report

killerbench-cli full-scan --report C:\Reports\scan.html --json

full-scan is diagnostic-only and rejects --auto-repair. Use a focused repair workflow when a specific action is needed. --report writes the same themed report the app exports. Use --scope to check only some areas, and common-check for combined JSON without a workflow journal.

Read exit codes

Code	Meaning
0	The preview or verified result succeeded.
1	A startup, input or journal error stopped the command.
2	The arguments were not recognized.
3	Blocked, failed or unverified.
4	A workflow needs a restart before it can verify.
130	You stopped it.

Exit 0 on a read-only command means it ran, not that the computer is healthy. Read the JSON for findings.

Make a change

Every command that can change the machine previews by default. Read the preview, then run the same command with --execute. If a request is interrupted, run the matching -recover command; it reports the real outcome and never repeats the change.

killerbench-cli dhcp-renew
killerbench-cli dhcp-renew --execute
killerbench-cli dhcp-renew-recover

Reopen old results

killerbench-cli workflow-journal C:\Users\me\AppData\Local\KillerBench\journal.json
killerbench-cli workflow-report journal.json report.html --include-repairs

Use it from an AI assistant

KillerMCP can call the installed CLI to look up Device Manager and Windows error codes.

Related

• Command line reference
• Troubleshooting

Diagnostics is where every visit should start. Each tool reads the machine and writes a report. Nothing here changes Windows. The default tool, the full system scan, runs a broad set of read-only checks and ranks what needs attention.

Step-by-step guides: Investigate crashes and blue screens and Repair system files.

Tools in this section

Check the machine first, then read the report for what needs attention and the next safe step.

Full system scan

Inspect 49 diagnostic areas and evaluate installed repair recipes for current evidence. Checks can take several minutes. Full system scan is diagnostic-only. Use a focused repair workflow to select and confirm one supported action after reviewing fresh prerequisites. Historical, backup and transfer snapshots remain read-only. Dump contents are not opened. Dirty-bit inspection does not schedule repair or restart. This scan does not install updates, change drivers, delete files or perform a complete hardware test.

Vitals

Capture available memory, provider-reported disk health and BitLocker protection status, then correlate current vitals with device problems, reliability history, hardware-error records, crash evidence, unexpected shutdowns and Windows Memory Diagnostic results. Restart indicators, system disk free space, elevation and update service configuration remain visible. Recovery passwords are not collected. No repairs run in this workflow. The combined result is not a complete hardware, software or stability test.

Reliability history

Read the last 14 days of Windows Reliability Monitor records together with recent Application errors and unexpected shutdown events, then return one bounded historical conclusion. Historical records do not establish current health or root cause. No repair is selected and no applications, services or settings are changed.

Startup performance

Read the last 14 days of Windows startup and shutdown performance event metadata, retaining only provider identity and bounded numeric duration fields, then correlate it with supported pending restart indicators. Paths, process names, accounts and other event payload are removed before evidence is saved. Historical degradation records do not identify a current bottleneck or authorize startup, service, application, driver, task, power, restart or policy changes.

Hardware error history

Read the last 14 days of Windows Hardware Error Architecture and Memory Diagnostic history, current Plug and Play device problems, physical-disk health and provider reliability counters, then return one bounded hardware conclusion. Records require correlation with their payload, firmware diagnostics and vendor hardware tests. No failing component or root cause is inferred, no repair is selected, and no hardware, firmware, driver, disk, pool, volume, file, service, power, restart or setting is changed.

Driver installation history

Read the retained tail of Windows SetupAPI device-install history, correlate failed sections with exact current Plug and Play identities and return one bounded conclusion. Historical log sections do not prove a device is still present or a failure is current. No driver is installed, removed, rolled back or updated.

System Restore points

List up to 256 available System Restore points, review explicit creation eligibility and return one bounded readiness conclusion. The inventory does not prove that protection is enabled for every volume or that a restore will succeed. No restore point is created, deleted or applied during diagnosis.

Windows Recovery Environment

Read the current Windows Recovery Environment configuration with REAgentC, correlate an enabled local location with the exact current disk and partition, and return one bounded readiness conclusion. Optional automatic repair can enable a disabled existing configuration, then verify its reported state. The recovery image is not downloaded, relocated or replaced, no recovery boot is initiated, and Windows is not restarted. Enabled status and partition presence do not prove that the recovery image can boot or repair this PC.

Windows activation

Read current Windows license status without collecting full or partial product keys, retain the last seven days of sanitized Software Protection warning, error and critical event metadata, then return one bounded operational conclusion. Event payload is removed before evidence is saved. Historical records remain context when current licensing reports Licensed. No activation, product-key, token, license, account, service or policy action is selected. Provider status and event history do not prove subscription entitlement, activation-server reachability, token-store integrity, future validity or root cause.

Windows services

Inventory installed service names, display names, states, start modes and privacy-bounded recovery action types without collecting accounts, executable paths, recovery commands or reboot messages. Review startup-mode coherence, direct dependency identities and cycles, repeat exact pending states, inspect supported services and dependencies of stopped services, then correlate recent Service Control Manager failures only when one exact service name or unique display name is present. Load-order group use is counted without expanding membership, and ambiguous identities remain unresolved. Stopped demand-start services can be normal. No service is started and startup, dependency and recovery settings are preserved. Use the corresponding Repair workflow when a specific feature needs recovery.

Application errors

Read recent Application error and critical events together with bounded Reliability Monitor history, then return one stability-history conclusion. Historical records do not prove a current fault or root cause and only direct narrower diagnosis. No applications are stopped, repaired, removed or reconfigured.

Display devices

Inspect graphics adapters and monitors for reported device errors, hardware IDs and installed driver versions. No driver installation, device reset or resolution change. Picture quality and physical connections are not tested.

Input devices

Inspect keyboard, mouse and HID device errors and driver inventory. No keystrokes are captured, devices reset or drivers changed. Physical input operation is not tested.

Device problems

Find nonzero Plug and Play configuration error codes across device classes, then correlate present device evidence with bounded SetupAPI driver installation, device setup and Plug and Play history. Historical records alone do not establish a current fault. Review exact device identity and approved driver evidence without changing hardware, drivers or configuration. Missing devices and physical operation are not verified.

Repair collects the tools that can fix something. Each one diagnoses first. A repair is offered only when fresh evidence shows the exact problem it fixes, and it runs only after you turn on Auto-repair confirmed issues or confirm a single repair yourself. Every repair is journaled and verified afterwards.

Step-by-step guides: Repair system files and Fix Windows Update.

Automatic and manual repair

Auto-repair confirmed issues lets a diagnostic tool run the repairs it proves are needed after the scan. It is off by default.

For a single servicing repair, open Advanced: logs and manual repairs and choose Repairs. Pick Component store (DISM) or System files (SFC), read the preview, tick Run this repair on this PC and press Run repair. See How changes stay safe for what happens before and after any change.

Tools in this section

Use this after a diagnosis identifies a problem. Repairs require confirmed evidence and explicit approval.

Core Windows services

Check Power, Plug and Play, User Manager, Group Policy Client, Network Store Interface, RPC Endpoint Mapper, Remote Procedure Call, DCOM Server Process Launcher, Background Tasks Infrastructure and CoreMessaging services together. Optional recovery starts only exact enabled automatic services that fresh evidence confirms are stopped after the startup window and complete dependency checks. Demand-start services remain unchanged when idle. Power plans, devices, drivers, accounts, credentials, profiles, policy, adapters, addresses, routes, DNS, firewall configuration, registrations, endpoints, task registrations, application data, service permissions and startup types are preserved. No policy refresh, device scan, account action, network change, power-setting change, registration change or task launch is requested. Verification covers stable service state only, not end-to-end feature behavior.

System files

Inventory bounded Windows servicing package, optional-feature and capability states, check prerequisites, scan protected system files, and automatically choose SFC only when the live check confirms corruption. Pending package, feature or capability states request review but do not authorize installation, removal, cleanup, rollback, enablement or disablement.

WMI repository

Check WMI service availability, then repository consistency. Auto-repair can start an eligible stopped service and salvage confirmed corruption, then verify each result. Disabled service settings are preserved. Readable registrations are merged; unreadable content may require provider reinstallation. Management clients may be interrupted. No reset, deletion or automatic rollback.

Windows system notifications

Read recent Service Control Manager history, then check COM+ Event System and System Event Notification Service together. Optional recovery verifies COM+ Event System readiness before starting SENS. Existing logon, network, power and COM+ notifications may resume under current configuration. COM+ catalogs, subscriptions, notification registrations, consumers, accounts, permissions, recovery settings, policy and startup types are preserved. No subscription, registration, consumer, account, permission or policy is changed. Verification covers stable service state only, not end-to-end notification delivery.

Diagnostic Policy Service

Review bounded Diagnostic Policy operational history, exact service-failure history and current service readiness. Incomplete evidence takes precedence. Historical records cannot authorize service recovery or a troubleshooting action. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing diagnostic scenarios may resume. Policy, troubleshooting data and startup type are preserved. No troubleshooter or suggested fix is run. Verification covers stable service state only, not fault detection, diagnosis completion or repair outcome.

Windows Error Reporting

Review crash-dump configuration, bounded dump-file metadata, recent system crash reports, exact Windows Error Reporting service-failure history and current service readiness. Historical reports do not establish a current fault or root cause and cannot authorize recovery. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing queued reports may resume under current policy. Report archives, dumps, consent, upload policy and startup type are preserved. No upload or deletion is requested. Verification covers stable service state only, not report creation, upload, delivery, problem resolution or crash diagnosis.

Windows Event Collector

Review bounded Windows Event Collector subscription inventory, exact service-failure history and current service readiness. An empty inventory can be intentional, and subscription count or historical failures cannot authorize recovery. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing subscriptions may resume remote event collection. Subscriptions, forwarded events, credentials, channel settings, policy and startup type are preserved. Verification covers stable service state only, not source reachability, authentication, remote delivery, event freshness or subscription health.

Windows Event Log

Inspect four diagnostic channels for enabled state, retention mode, current size, configured limit, record count and saturation, then check Windows Event Log service availability. Auto-repair can start a stopped, enabled service after checking dependencies and verify running state. A separately confirmed focused action can enable one exact disabled unmanaged diagnostic channel while preserving every other reported setting. Logs, channel permissions, retention, size limits, startup types and managed settings are preserved. Successful event delivery and archive capacity remain unverified.

Windows Time service

Check Windows Time configuration, service and synchronization. Auto-repair can start W32Time when the current status reports the exact stopped-service error and fresh policy, mode and dependency checks pass, then request a resync and verify fresh status. This can adjust the clock using existing configured sources. Startup type, source configuration and managed settings are preserved.

Task Scheduler service

Inventory bounded scheduled-task state, runtime results and missed-run counts, then combine them with exact Task Scheduler service failure history before checking current service availability. Task findings and historical service failures cannot authorize a service start. Optional recovery starts only an enabled, stopped exact service after fresh dependency checks. Existing enabled tasks may begin under their configured accounts, including missed triggers. No task definition, principal, credential reference, policy or startup type is changed, and no task is directly started or deleted. Verification covers stable service state only, not action success, credential validity or future task outcomes.

User Profile Service

Check User Profile Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing sign-in and profile requests may resume. Profile folders, registry hives, permissions, profile-list registrations, credentials, user data, policy, service permissions and startup type are preserved. No profile operation is requested. Verification covers stable service state only, not sign-in, profile loading or user-data access.

Backup services

Check Volume Shadow Copy, Microsoft Software Shadow Copy Provider, Windows Backup and Block Level Backup Engine services, then read VSS writer status, registered provider types, current snapshots and shadow-storage allocation. Stopped demand-start services can be normal when idle. Optional recovery starts only stopped automatic services after dependency checks, then verifies running state. Existing scheduled or interrupted backup work may resume. Disabled and demand-start startup settings, snapshots, shadow storage, provider registrations, backup plans, catalogs, schedules, targets, credentials and retention are preserved. No backup is selected or reconfigured, no service is restarted, and no snapshot or catalog is deleted. Provider registration, writer status, storage allocation and stable service state do not verify backup completion, destination access or restore success.

Updates covers Windows Update, the services behind it and the component store. You can see what is installed, what is pending and why an update fails, and you can review available updates before choosing any to install.

Step-by-step guides: Fix Windows Update and Repair system files.

Tools in this section

Watch servicing activity, review available updates and repair the Windows Update chain.

Servicing activity monitor

Observe bounded Windows Update and Setup servicing activity over one or more snapshots. Options control refresh timing and whether update events, update history, the exact Windows Update scheduled task, exact service states, restart indicators, current-account background transfers, Delivery Optimization activity and privacy-bounded Windows Installer activity are included. Process IDs, command lines, users and paths are excluded. Activity does not prove progress, completion, a stall or a fault. No update, setup, transfer, task, service, process, policy, restart or repair action is requested.

Available updates

Discover selected software and driver updates using the configured source, Windows Update or an already registered Microsoft Update service. Source readiness is checked before discovery. Discovery installs nothing and accepts no license, registers no source and changes no policy. Selected updates can be installed afterward, separately, only after you tick the confirmation checkbox. This is separate from servicing repair.

Windows Update

Inventory bounded Windows servicing package, optional-feature and capability states, check restart indicators, free space and update services, observe Delivery Optimization without starting it, then scan the component store and protected system files. Pending package, feature or capability states request review but do not authorize a component action. Auto-repair can start stopped Windows Update, BITS, Cryptographic Services, Windows Modules Installer and Update Orchestrator services that are set to start automatically. A stopped demand-start service is reported, not started. Starting Update Orchestrator may resume existing scheduled update activity under current policy. Packages, optional features, capabilities, Delivery Optimization cache, peer, bandwidth, policy, source enrollment, schedules and startup settings are preserved. DISM or SFC requires live evidence of corruption. No update is selected or approved by this workflow.

Windows Update Service

Check exact Windows Update Service state, its registered service DLL, bounded current update activity and exact service-failure history. DLL observations, update activity and historical failures cannot authorize a service start or update operation. Optional recovery starts only a stopped automatic service after fresh dependency and executable-registration checks. A stopped demand-start service remains informational. Existing update activity may resume under current policy. Update policy, source enrollment, schedules, restart settings, packages, BITS jobs, service permissions and startup type are preserved. KillerBench selects, approves or installs no update. Verification covers stable service state only, not source reachability, applicability, download, installation, completion or restart readiness.

Delivery Optimization

Check the exact Delivery Optimization service state. A stopped demand-start service remains informational. Only an exact Paused state can offer recovery. Optional recovery repeats the state check, sends one bounded continue request and requires two coherent Running observations. Startup type, cache contents, peers, bandwidth, update source and managed policy are preserved. Transfer activity, cache health, update progress and completion remain unverified.

BITS service

Check the exact Background Intelligent Transfer Service state, current-account transfer jobs and bounded exact service-failure history. Historical failures and transfer snapshots cannot authorize a service start. Optional recovery starts only the exact service when it is stopped and set to start automatically, after fresh dependency checks. A stopped demand-start service remains informational. Existing applications may resume queued background transfers. Jobs, priorities, owners, destinations, proxy settings, policy and startup type are preserved. Verification covers stable service state only, not transfer progress, application ownership or completion.

Background transfers (BITS)

Read BITS transfer jobs in the selected account scope and review exact job identities. Queue names do not establish application ownership. No transfers are resumed, completed, canceled, deleted or reassigned.

Cryptographic Services

Check exact Cryptographic Services state, its registered service DLL and bounded exact service-failure history. Historical failures and DLL observations cannot authorize a service start or component replacement. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing catalog, certificate and update operations may resume. Certificates, keys, catalogs, trust settings, policy and startup type are preserved. Verification covers stable service state only, not certificate, signature, catalog or trust validation.

Windows Modules Installer

Check exact Windows Modules Installer state, bounded servicing package transitions and exact service-failure history. Historical failures and package states cannot authorize a service start or package operation. Optional recovery starts only the exact service when it is stopped and set to start automatically, after fresh dependency checks. A stopped demand-start service remains informational. Existing servicing activity may resume. Packages, component-store content, sources, policy and startup type are preserved. Verification covers stable service state only, not component-store health, package applicability, servicing completion or restart readiness.

Windows Update Medic Service

Check exact Windows Update Medic Service state, its registered service DLL, bounded current update activity and exact service-failure history. DLL observations, update activity and historical failures cannot authorize a service start or component action. A stopped demand-start service can be normal. When this exact tool is selected, optional recovery can start only the stopped enabled service after fresh dependency checks. Windows remediation may resume under current policy and can repair update components or trigger update activity. Update policy, source enrollment, schedules, packages, BITS jobs, restart settings, service permissions and startup type are preserved. KillerBench selects no update and changes no update setting. Verification covers stable service state only, not remediation, component health, applicability, download, installation or restart readiness.

Update Orchestrator Service

Check exact Update Orchestrator Service state, the exact built-in Windows Update task, bounded current activity and exact service-failure history. Task results, update activity and historical failures cannot authorize a service start or update operation. Optional recovery starts only a stopped automatic service after fresh dependency and executable-registration checks. A stopped demand-start service remains informational. Existing scheduled update activity may resume under current policy and can download or install already approved updates. Update policy, source enrollment, schedules, restart settings, packages, BITS jobs, service permissions and startup type are preserved. KillerBench selects or approves no update. Verification covers stable service state only, not applicability, download, installation, completion or restart readiness.

Component-store cleanup

Analyze whether Windows recommends component-store cleanup. Optional maintenance removes superseded components immediately, then analyzes again. No ResetBase or manual WinSxS deletion. No automatic undo; reclaimed disk space is not measured.

Devices covers printers, audio, cameras, Bluetooth, input and the Windows services that attached hardware relies on.

Step-by-step guides: Fix printing problems and Investigate crashes and blue screens.

Tools in this section

Printing, audio, cameras, Bluetooth, input and the services behind attached hardware.

Printing

Check the Print Spooler, local queue pauses, visible print jobs, offline settings and driver-reported conditions, then inventory queue, driver, port, Standard TCP/IP endpoint, print processor and print monitor registrations. Correlate recent PrintService problems only when one exact current queue identity is present. Assigned Standard TCP/IP endpoints receive one bounded connection attempt without application data, SNMP or a print job. Auto-repair can start the enabled spooler, resume only exact paused queues with fresh waiting-job evidence, and clear offline mode. Idle intentional pauses remain review-only. Remote connections, SNMP community strings, extension registrations and job contents are preserved. A condition code or successful connection does not establish printer identity, supplies, mechanics, queue acceptance, rendering success or physical printing.

Audio

Check the default multimedia input and output identities and shared formats, audio device and driver state, Audio Endpoint Builder and Windows Audio. Auto-repair starts stopped, enabled services and verifies running state. Startup settings, drivers, selected devices, exclusive mode and volume levels are preserved. Sound playback, recording and application routing remain untested.

Camera support

Inspect camera and imaging device errors, hardware IDs, installed driver evidence and Windows Camera Frame Server availability. Optional recovery starts only an enabled, stopped service after dependency checks. An application already requesting camera access may resume under existing permissions. Camera privacy settings, permissions, device configuration, policy, drivers and startup type are preserved. No reset, permission change or driver installation. Verification covers reported device configuration and service running state only, not image capture, privacy access or physical operation.

Bluetooth support

Inspect Bluetooth device errors, hardware IDs, installed driver evidence and Bluetooth Support Service availability. Optional recovery starts only an enabled, stopped service after dependency checks; paired devices may reconnect. Pairings, radio settings, device configuration, policy and startup type are preserved. No reset, device removal or driver installation. Verification covers reported device configuration and service running state only, not discovery, pairing, audio or data transfer.

Smart card support

Inspect smart-card reader errors, hardware IDs, installed driver evidence and Smart Card service availability. Optional recovery starts only an enabled, stopped service after dependency checks. Applications may resume detecting inserted cards under existing policy. Certificates, PINs, credentials, reader and card configuration, policy, drivers and startup type are preserved. No initialization, enrollment, PIN operation, reader reset or driver installation. Verification covers reported reader configuration and service running state only, not card detection, authentication or application access.

Biometric support

Inspect biometric device errors, hardware IDs, installed driver evidence and Windows Biometric Service availability. Optional recovery starts only an enabled, stopped service after dependency checks. Existing Windows Hello and application requests may resume under current policy. Biometric templates, Windows Hello data, credentials, device configuration, permissions, policy, drivers and startup type are preserved. No enrollment, template deletion, sensor reset, permission change or driver installation. Verification covers reported sensor configuration and service running state only, not capture, matching, sign-in or application access.

Human Interface Device Service

Check Human Interface Device Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing hot buttons, media controls and other HID features may resume. Devices, drivers, button mappings, accessibility settings, input settings, policy, service permissions and startup type are preserved. KillerBench selects no device, driver, mapping or input setting operation. Verification covers stable service state only, not button, control or application behavior.

Portable Device Enumerator Service

Check Portable Device Enumerator Service availability. Optional recovery starts only the exact service when it is stopped and set to start automatically, after fresh dependency checks. A stopped demand-start service remains informational. Existing applications may resume detecting and accessing connected portable devices. Devices, drivers, files, libraries, synchronization settings, permissions, policy, service permissions and startup type are preserved. KillerBench selects no device, file, library, synchronization or transfer operation. Verification covers stable service state only, not enumeration, access, synchronization or transfer.

Windows Image Acquisition

Check Windows Image Acquisition service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing scanner and still-image acquisition requests may resume under current application permissions. Devices, drivers, image data, application permissions, privacy settings, transfer settings, policy, service permissions and startup type are preserved. KillerBench selects no device, driver, image, permission, transfer or acquisition operation. Verification covers stable service state only, not scanner, camera, transfer or application operation.

Shell Hardware Detection

Inspect bounded storage-controller, disk and portable-device Plug and Play evidence and installed driver references, then check Shell Hardware Detection service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing AutoPlay and hardware-arrival notifications may resume under current policy. Device observations and retained history cannot authorize recovery. Devices, drivers, volumes, mount points, AutoPlay settings, handlers, policy, service permissions and startup type are preserved. No device or setting operation is requested. Verification covers stable service state only, not notification delivery, media readiness, volume access or physical device operation.

Device Install Service

Check Device Install Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Windows-requested device installation work may resume under current policy. Devices, drivers, packages, configuration, bindings, class settings, policy, service permissions and startup type are preserved. KillerBench selects and installs nothing. Verification covers stable service state only, not device installation or operation.

Device Association Service

Check recent device setup and Plug and Play history, then check Device Association Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Windows-requested device association work may resume. Paired and associated devices, drivers, credentials, metadata, permissions, policy, service permissions and startup type are preserved. KillerBench selects no device, pairing, removal, reset or driver operation. Verification covers stable service state only, not discovery, pairing, association or device operation.

Display Enhancement Service

Inspect graphics adapter and monitor evidence, then check Display Enhancement Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing brightness, color and enhancement requests may resume. Display configuration, brightness, color profiles, HDR settings, devices, drivers, power settings, policy, service permissions and startup type are preserved. No display setting is changed. Verification covers stable service state only, not enhancement behavior, picture quality or physical display operation.

Text Input Management Service

Inspect keyboard, mouse and HID device evidence, then check Text Input Management Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing touch keyboard, handwriting, emoji and advanced text-input requests may resume. Dictionaries, handwriting data, language and keyboard settings, accessibility and privacy settings, devices, drivers, policy, service permissions and startup type are preserved. No text input, keystroke or handwriting content is collected. Verification covers stable service state only, not text entry, recognition or device operation.

Windows Font Cache Service

Check Windows Font Cache Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing applications may resume using the current font cache. Installed fonts, font files, application data, cache files, policy, service permissions and startup type are preserved. KillerBench installs or removes no font and does not delete or rebuild the cache. Verification covers stable service state only, not text rendering or application behavior.

Function Discovery Provider Host

Check Function Discovery Provider Host availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing applications may resume discovering network devices through installed providers. Network profiles, shares, devices, providers, firewall rules, discovery settings, credentials, policy, service permissions and startup type are preserved. KillerBench selects no device, share, provider, firewall rule or discovery setting operation. Verification covers stable service state only, not provider health, device discovery or connectivity.

Function Discovery Resource Publication

Check Function Discovery Resource Publication availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. This PC may become discoverable through existing network discovery and firewall settings. Network profiles, shares, published resources, firewall rules, discovery settings, credentials, policy, service permissions and startup type are preserved. KillerBench selects no share, resource, firewall rule or discovery setting operation. Verification covers stable service state only, not publication, visibility, access or connectivity.

Network inspects connections, DNS, routes, wireless and wired sign-in, file sharing and remote access. Tools that reach another host use the target and timeout you set, and nothing is changed unless you confirm a repair.

Step-by-step guides: Fix network and internet problems.

Tools in this section

Inspect connections, DNS, routes, wireless, sharing and remote access.

Network

Inspect adapters, address state and origin, gateways, DNS configuration, effective DNS namespace policy, TCP settings, native Winsock protocol and namespace-provider catalog structure, the IP routing table and Hosts file mappings. Auto-repair can start enabled DNS Client, DHCP Client, SMB client, Network Location Awareness, Network List and IP Helper services and renew connected physical DHCP adapters lacking a usable IPv4 address. Starting network-identification services may recalculate network identity and apply a different existing firewall profile. IP Helper may activate existing IPv6 transition, port-proxy and network-notification features. Service recovery verifies running state, not successful name resolution, route selection, network identification or tunnel operation. Routes, Hosts entries, DNS servers, profiles, firewall rules, Winsock providers, transition configuration, startup types and policies are preserved. Renewal may change leased addresses and interrupt connections. Static settings and virtual adapters are preserved. Exact gateway ICMP responses do not verify Internet reachability.

Wireless networking

Inspect network devices and WLAN AutoConfig availability. Optional recovery starts only an enabled, stopped service after dependency checks; saved profiles may reconnect automatically. Profiles, credentials, policy, radio settings and startup types are preserved. No adapter reset or driver installation. Verification covers running state, not wireless authentication or connectivity.

Wired authentication (802.1X)

Inspect network devices and Wired AutoConfig for networks requiring 802.1X. Optional recovery starts only an enabled, stopped service after dependency checks. Existing authentication profiles may activate and change network access. Certificates, credentials, profiles, policy and startup settings are preserved. Verification covers running state only, not authentication or connectivity.

Network Connections

Review bounded current network profile assignments, exact service-failure history and current Network Connections service readiness. Incomplete evidence takes precedence. Public profiles and historical failures remain context and cannot authorize recovery or a network change. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing network-management interfaces may resume. Adapters, addresses, routes, DNS settings, connection profiles, credentials, firewall configuration, policy and startup type are preserved. No connection or network setting is changed. Verification covers stable service state only, not adapter operation, address assignment, routing, name resolution or connectivity.

WinHTTP Auto-Proxy

Review stored WinHTTP defaults, current-account Internet settings, exact service-failure history and current WinHTTP Auto-Proxy readiness. Incomplete evidence takes precedence. Proxy configuration and historical failures cannot authorize service recovery or discovery. A stopped demand-start service can be normal. When this exact tool is selected, optional recovery can start only the stopped enabled service after fresh dependency checks. Existing applications may resume WPAD or PAC discovery under current settings. Proxy definitions, PAC URLs, credentials, network settings, firewall configuration, policy, service permissions and startup type are preserved. No URL is fetched and no proxy or network setting is changed. Verification covers stable service state only, not discovery, reachability, authentication, policy ownership or application use.

Windows Connection Manager

Review bounded current network profile assignments, exact service-failure history and current Windows Connection Manager readiness. Incomplete evidence takes precedence. Public profiles and historical failures remain context and cannot authorize recovery or a connection decision. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Windows may resume automatic connection decisions under existing profiles and policy. Adapters, profiles, credentials, metering, cost, roaming, firewall, VPN and authentication settings and startup type are preserved. No profile, adapter or setting is changed. Verification covers stable service state only, not profile applicability, connection selection, authentication, routing, name resolution or connectivity.

Network Setup Service

Review bounded current adapter protocol bindings, exact service-failure history and current Network Setup Service readiness. Incomplete evidence takes precedence. Binding state and historical failures cannot authorize service recovery or a setup change. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing pending network setup may resume under Windows policy. Adapters, drivers, driver packages, bindings, addresses, routes, DNS settings, profiles, credentials, firewall configuration, policy and startup type are preserved. KillerBench selects no driver or configuration change. Verification covers stable service state only, not adapter availability, driver suitability, setup completion, address assignment, routing, name resolution or connectivity.

File sharing (SMB)

Check Windows SMB server availability. Optional recovery starts only an enabled, stopped Server service after fresh dependency checks. Existing file and printer shares may become reachable under their current permissions and firewall policy. No share, permission, SMB setting, firewall rule, credential, policy or startup type is changed. Verification covers stable service state only, not client access or file transfer.

Remote Access Connection Manager

Review bounded current-account VPN profile configuration, exact service-failure history and current Remote Access Connection Manager readiness without collecting secrets. An empty inventory can be intentional, and profile presence, connection labels or historical failures cannot authorize recovery or a connection attempt. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing dial-up and VPN requests may resume. Connection profiles, credentials, routes, adapters, authentication settings, policy and startup type are preserved. No connection is initiated. Verification covers stable service state only, not profile applicability, server reachability, authentication, tunnel negotiation, route installation, name resolution or connectivity.

Remote Desktop Services

Review local Remote Desktop enablement, Network Level Authentication and listener port, bounded connection and session history, exact service-failure history and current service readiness. Incomplete evidence takes precedence. Historical records cannot authorize service recovery or configuration changes. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. An existing listener may become reachable under current policy, NLA, firewall rules and permissions. Remote Desktop enablement, listeners, certificates, ports, firewall rules, NLA, permissions, sessions, policy, service permissions and startup type are preserved. No listener, firewall rule, account access, certificate or session is created or changed. Verification covers stable service state only, not effective policy, listener binding, firewall access, certificate identity, permissions, authentication, network reachability, connection success or session creation.

Windows Remote Management

Review bounded WinRM listener configuration, operational history, exact service-failure history and current service readiness. Incomplete evidence takes precedence. Disabled listeners or current service concerns request review, while historical records cannot authorize recovery or configuration changes. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing WS-Management listeners may become reachable under current authentication, certificate, firewall, TrustedHosts and policy settings. Listeners, addresses, ports, certificates, authentication, encryption, TrustedHosts, firewall rules, permissions, quotas, policy, service permissions and startup type are preserved. No listener, firewall rule, trust entry, certificate, credential or remote session is created or changed. Verification covers stable service state only, not effective policy, listener binding, firewall access, certificate validity, authentication, permissions, client reachability or remote command execution.

Apps reviews installed programs, Store packages, Office and Outlook, browser extensions, startup apps and search. Removal and reset tools always show a review first and change only what you select.

Step-by-step guides: Set up a new computer.

Tools in this section

Review installed applications, Store packages, Office and Outlook, browser extensions and search.

Installed applications

Read application uninstall registrations in the selected machine or running-account scope, then combine that scope with bounded Application error, Reliability Monitor and restart evidence. Other accounts and portable apps are excluded. Registrations and broad history are not exact application-health or ownership proof. No installer, uninstaller, application, process, service, file, registration, account, policy or restart action is selected.

App packages

Inventory registered Appx/MSIX packages for the selected account scope. Running account is the default; all users requires administrator access. Report exact identities, framework and non-removable flags, and dependency counts. Provisioned packages, Win32 applications, managed ownership and application data are not evaluated. No packages are removed.

Browser extensions

Inventory bounded Chrome, Edge, Brave and Firefox extension identities from the running account. Browser history, credentials, extension settings, manifest contents, commands and policy values are excluded. Presence does not prove enablement, trust, ownership or safe removal. No browser, extension or policy is changed.

Startup applications

Inventory machine and running-account Run and RunOnce registration names, Startup folder file names, Windows startup approval states, and boot or logon scheduled-task names and states, then return one startup-environment conclusion. Command lines, target paths, binary approval timestamps, task actions, arguments, accounts and credentials are not collected. Registration does not prove an item ran, caused a delay, is unwanted or is safe to disable. Approval state does not prove a matching registration exists. No registration, file, application, task, service or policy change is selected.

Microsoft app removal

Review selected OneDrive, Outlook, Office/M365, Project and Teams registrations with account-scope and retention choices. Machine, running-account and registered-package inventories are correlated; all-user review also includes packages provisioned for new users. A supported current-account package can receive a separate exact safeguard plan in the desktop or CLI. Removing that one package is a separate guarded desktop action with its own confirmations. The review itself changes no process, application, package, file, credential, folder location, registry value or user data.

Outlook reset

Review New Outlook, Classic Outlook or both with explicit choices for caches, profile settings, authentication, OST files, add-ins and New Outlook reinstall. Running-account review checks bounded known locations, exact registrations and closed-process readiness. A separately confirmed cache-only action retains exact cache directories under unique recovery names and verifies every move. All-user review and other reset areas remain review-only. No retained cache, profile, OST file, credential, add-in, package or setting is removed.

Foxit inventory

Inventory machine-installed Foxit products and updater registry values in both views. User installations, effective policy and product ownership are not verified. No applications or settings are changed.

Windows Installer service

Check Installer restriction, rollback, elevation, logging and debug policy, in-progress markers, engine binaries and registered cached-package visibility before service recovery. Correlate recent failed and successful outcomes only for exact reported product identities. If prerequisites pass, auto-repair can start the enabled service and verify Running. Historical outcomes, logging, cache visibility and debug findings do not authorize package or policy changes. Policies, logs, transaction markers, startup types and cached packages are preserved. A specific package installation is not tested.

Windows Search

Check Windows Search service availability, current SystemIndex activity and recent Search event history. Auto-repair can start a stopped, enabled service and verify running state. A separate explicit index-rebuild choice retains the prior index, starts a fresh index and verifies exact service and directory state. Indexed locations, policy, startup type and retained data are preserved. Starting the service or rebuilding the index can resume background indexing. Search result completeness remains untested.

App Readiness

Check App Readiness service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing first-sign-in and application provisioning may resume under current policy. Packages, registrations, licenses, user profiles, application data, policy and startup type are preserved. KillerBench selects no package operation. Verification covers stable service state only, not sign-in, provisioning or application launch.

State Repository Service

Check State Repository Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing application-model state requests may resume. Registrations, packages, licenses, profiles, browser and application data, repository content, policy and startup type are preserved. No reset, re-registration or deletion is requested. Verification covers stable service state only, not repository consistency or application operation.

AppX Deployment Service

Check AppX Deployment Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing deployment, registration or servicing requests may resume under current policy. Packages, registrations, licenses, profiles, application data, repository content, policy, service permissions and startup type are preserved. KillerBench selects no package operation. Verification covers stable service state only, not deployment, registration or application launch.

Client License Service

Check Client License Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Store application license requests may resume under current policy. Packages, registrations, licenses, tokens, accounts, profiles, application data, policy, service permissions and startup type are preserved. KillerBench selects no package, license, token or account operation. Verification covers stable service state only, not license validation or application launch.

Microsoft Store Install Service

Check recent Microsoft Store installation history and exact Store Install Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Store download and installation requests may resume under current policy. Packages, registrations, licenses, accounts, application data, download state, sources, policy, service permissions and startup type are preserved. KillerBench selects no package, download, license, account, source or installation operation. Verification covers stable service state only, not download, installation, license or application outcomes.

Windows License Manager Service

Check Windows License Manager Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing application license checks may resume under current policy. Packages, registrations, licenses, tokens, accounts, application data, policy, service permissions and startup type are preserved. KillerBench selects no package, license, token, account, registration or entitlement operation. Verification covers stable service state only, not license validation, entitlement or application launch.

Windows PushToInstall Service

Check Windows PushToInstall Service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. An existing previously approved remote installation request may resume under current policy. Packages, registrations, licenses, accounts, application data, queued requests, sources, policy, service permissions and startup type are preserved. KillerBench creates, approves and selects no request, package, source, account or installation. Verification covers stable service state only, not request processing, download, installation or application outcomes.

Maintenance keeps a machine tidy: file cleanup, old user profiles, scheduled tasks and decluttering Windows. Every tool previews what it would remove before anything is deleted.

Step-by-step guides: Free up disk space and Make Windows more private.

Tools in this section

Clean up files, profiles and scheduled tasks, and declutter Windows.

Cleanup

Estimate selected temporary-file, cache and retained diagnostic-evidence targets using the age and file-limit settings in the main panel. Windows Temp and Windows SystemTemp are independent targets. Delivery Optimization is a separate cache choice and removed content may need to be downloaded again. Optional permanent removal uses the separate cleanup checkbox, rechecks retained candidates within the selected limit and records each outcome. Deletion bypasses the Recycle Bin. Targets, age and file limits are also configurable through the cleanup CLI command.

Profiles

Review Windows profiles using the selected age threshold, exact ProfileList registrations and optional service and scheduled-task account dependencies, then return one bounded review conclusion. Loaded, system and current-account profiles are excluded from review eligibility. Candidates remain review-only. No profile, folder, registry key, account, service, task, credential, policy or file is changed, and no removal is selected. Application dependencies and backup recoverability remain unverified.

Scheduled tasks

Inventory visible scheduled tasks, states and reported principals. No tasks are started, registered or changed. Actions, triggers and execution success are not verified.

Declutter Windows

Review explicit Windows cleanup areas such as Recall and AI, telemetry, search suggestions, consumer content, taskbar and Start, notifications, Edge, power, hibernation, Office languages and preinstalled software for the running account or all profiles. Review is read-only. High performance power, sleep and display timers, and hibernation can each be changed when that area is the only selection, with fresh evidence and explicit confirmation.

Onboarding prepares a new computer. It reviews the applications and configuration you select and names the computer. It does not download or install anything by itself.

Step-by-step guides: Set up a new computer.

Checking an installer before you run it

The command line can verify a vendor installer before you run it:

killerbench-cli depot-verify-installer chrome C:\Installers\ChromeSetup.exe

KillerBench trusts an installer only when it carries a valid Authenticode signature from the vendor's exact organization name. It never runs the installer.

Tools in this section

Prepare a new computer: applications, name and configuration.

Onboarding

Review explicitly selected provisioning applications and configuration groups. Current uninstall, app-package and Office Click-to-Run registrations are correlated without downloading or executing installers. Configuration selections describe consequences and route to separately guarded workflows when implemented. No download, installation, account, update, cleanup, policy, registry, service, profile or restart action occurs.

Computer name

Review the proposed computer name against current identity and domain role. No rename, credential collection or restart. Name availability, permissions and application dependencies remain unverified.

Security inspects Microsoft Defender, the firewall, certificates and the sign-in services. It also exposes the TPM and platform security state that BitLocker and Windows Hello depend on.

Step-by-step guides: Encrypt a drive with BitLocker and Make Windows more private.

Tools in this section

Inspect protection, firewall, certificates and sign-in services.

Microsoft Defender

Inspect Defender protection and signature status. Auto-repair refreshes signatures only when Defender reports active protection and outdated signatures. Uses configured signature sources. No protection, exclusion or policy changes; no malware scan.

Windows Security Center

Review bounded antivirus registrations with raw provider state, exact service-failure history and current Windows Security Center readiness without interpreting protection health. An empty inventory is not a protection-health verdict, and registration count, raw state or historical failures cannot authorize recovery or a security change. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing security status monitoring and notifications may resume. Antivirus configuration, provider registrations, protection settings, exclusions, notifications, policy and startup type are preserved. No scan, update or protection change is requested. Verification covers stable service state only, not antivirus presence, protection state, signature freshness, notification delivery, registration ownership or effective policy.

Firewall services

Read Domain, Private and Public profile enabled settings from ActiveStore, then check Base Filtering Engine and Windows Defender Firewall services. Optional recovery starts only enabled, stopped services after fresh dependency checks. Existing filtering policy may take effect and interrupt network or remote access. Startup types, service permissions, firewall rules, profiles and IPsec settings are preserved. No resets, rule changes or service stops. Verification establishes service running state only; effective protection and connectivity remain unverified.

Certificate expiration

Inspect certificate dates and build cache-only local trust chains for the machine and current-user personal stores, then return one bounded operational conclusion. Revocation, server presentation, bindings, enrollment, policy ownership, remote trust and private-key usability remain unverified. No certificate, trust setting, enrollment, binding, private key, application, service or policy is changed.

Credential Manager

Check Credential Manager service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing applications may resume requests for stored credentials. Vault contents, passwords, passkeys, certificates, tokens, credential registrations, permissions, policy, service permissions and startup type are preserved. No credential content or operation is requested. Verification covers stable service state only, not credential retrieval, authentication or application access.

Web Account Manager

Review payload-sanitized account broker history and exact Web Account Manager availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing applications may resume account and token requests under current policy. Historical events cannot authorize recovery or establish current account state. Accounts, credentials, tokens, cookies, application registrations, permissions, sign-in state, policy, service permissions and startup type are preserved. KillerBench selects no account, credential, token, cookie, permission or sign-in operation. Verification covers stable service state only, not authentication, token issuance or application access.

Microsoft Account Sign-in Assistant

Review payload-sanitized account broker history and exact Microsoft Account Sign-in Assistant availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Microsoft account sign-in requests may resume under current policy. Historical events cannot authorize recovery or establish current account state. Accounts, credentials, tokens, device registration, application data, permissions, sign-in state, policy, service permissions and startup type are preserved. KillerBench selects no account, credential, token, registration, permission or sign-in operation. Verification covers stable service state only, not authentication, account connectivity or application access.

BitLocker inspects drive encryption, protectors and recovery information, then helps you back up, protect or change a drive. It works on this computer only.

Step-by-step guides: Encrypt a drive with BitLocker.

Using the BitLocker tool

Choose the drive letter and an Operation, then press Run diagnosis.

• Inspect reads encryption state, protection status and protector identities. It is the default and changes nothing.
• Back up recovery writes the selected recovery password to a new file outside the protected drive and verifies it. Press Find recovery protectors first, choose the protector, then confirm the backup.
• Encrypt backs up the selected recovery password, verifies the backup, then starts encryption once with the method you choose. The Windows drive needs a TPM protector and a recovery password. A data drive needs only a recovery password.
• Resume protection turns protection back on for a fully encrypted drive where it was suspended.

Each of these needs its own confirmation box, and KillerBench rechecks the drive immediately before it acts.

More BitLocker actions

Open More BitLocker actions for changes that sit outside Run diagnosis. Choose an action, press Preview to read exactly what it requires, then confirm and press Run action.

• Turn on auto-unlock makes an encrypted data drive unlock when Windows starts. The Windows drive must be fully encrypted with protection on.
• Add a TPM protector or Add a recovery password creates one new protector. KillerBench never shows or logs a new recovery password, so back it up straight away.
• Back up the recovery password to Active Directory or Microsoft Entra ID sends the protector you selected above. KillerBench reports that Windows accepted the request. It cannot read the directory copy, so confirm it there.
• Decrypt this drive starts decryption, for example before encrypting again with a required method. It needs a second confirmation because the drive is unprotected afterwards, and it refuses the Windows drive while other drives auto-unlock from it.

TPM and FIPS

If the TPM is present but not ready, the Security section can prepare it without clearing it. KillerBench never clears a TPM, because that destroys keys held by BitLocker and Windows Hello. The FIPS algorithm policy switch is available as an explicit, reversible repair for organizations that need FIPS-approved BitLocker PINs.

Tools in this section

Inspect encryption, protectors and recovery information, then back them up or protect the drive.

BitLocker

Preview BitLocker options and inspect the selected volume. No encryption or recovery backup is performed by this workflow.

Privacy reads the privacy settings for this machine and the account running KillerBench, then lets you change the ones you choose. It goes beyond the Windows Settings app, covering app permissions, cloud search and search highlights.

Step-by-step guides: Make Windows more private.

Reviewing and changing settings

Select the privacy areas to inspect and press Run diagnosis. Every area starts unchecked and the review is read-only.

To change a setting, use the Privacy setting control. KillerBench checks whether a policy or device management already owns the setting, records the current value, makes the one change you asked for and reads it back to confirm it. Settings owned by policy are left alone.

The settings include advertising choices, clipboard history, 19 app-permission settings such as camera, microphone and location, cloud content search for personal and work accounts, and search highlights.

Tools in this section

Review and change app permissions, suggestions, search and advertising settings.

Privacy

Read selected privacy registry settings for this machine and the account running KillerBench. Separate explicit controls can change Clipboard history or a supported account setting after fresh policy checks, durable preparation and exact verification. Other privacy selections remain read-only. Registry snapshots do not prove effective permissions or policy ownership.

Inspect disks, volumes, Storage Spaces and drive maintenance services. Diagnosis does not select a disk operation; any supported machine-changing action needs its own exact target, prerequisites and confirmation.

Step-by-step guides: Check and repair a drive and Free up disk space.

Tools in this section

Storage

Map bounded disk, partition and drive-letter volume identities, evaluate 10% free-space pressure across every drive-letter volume, inspect VSS shadow-storage allocation and per-volume quota defaults, summarize current Storage module job progress, check the selected NTFS volume and its online self-healing state, and inspect disk/controller devices across this PC. Capacity thresholds, quota settings and job states are review evidence and do not select cleanup, resizing, quota changes or job control. Drive-letter mapping is point-in-time and does not cover every mount path. Device findings are not mapped to the selected volume. The Windows volume is the default. No files, snapshots, jobs or drivers are changed, no setting is changed, no volume is dismounted, and no restart is scheduled.

Storage Spaces

Inventory non-primordial Storage Spaces pools and virtual disks, including health, operational state, capacity, allocation and resiliency, then return one bounded operational conclusion. Windows may demand-start its Storage Spaces management provider while answering this read-only query. Pools, virtual disks, physical disks, volumes, resiliency, allocation, maintenance settings, policy and startup type are preserved. No pool, disk, volume, allocation, attachment, repair, optimization or setting operation is requested. Provider results do not verify pool accessibility, redundancy, data integrity, backup recoverability or application I/O.

Storage Service

Review bounded current Storage module jobs, exact service-failure history and current Storage Service readiness. Incomplete evidence takes precedence. Job state and historical failures cannot authorize service recovery or storage changes. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing storage notifications and policy-managed storage activity may resume. Volumes, partitions, filesystems, mount points, devices, drivers, Storage Sense settings, maintenance policy, service permissions and startup type are preserved. KillerBench selects no job, volume, partition, mount point, file, device, driver or storage setting operation. Verification covers stable service state only, not job outcome, device, volume or storage-policy operation.

Optimize Drives service

Check Optimize Drives service availability. Optional recovery starts only the enabled, stopped exact service after fresh dependency checks. Existing Windows-scheduled optimization activity may resume under current maintenance policy. Volumes, filesystems, data, optimization schedules, maintenance policy, service permissions and startup type are preserved. KillerBench does not select a volume, analyze, trim, defragment, optimize or schedule any drive. Verification covers stable service state only, not analysis, optimization or device health.

Every run produces a report you can read, filter and export. The report always separates what was proven from what was only observed.

States you will see

State	Meaning
Needs review	The evidence supports a problem that deserves attention.
Information	Evidence was collected and is shown for context.
Incomplete or Unknown	A check could not finish or the evidence was unavailable. It is never counted as healthy.
Historical	An event from the past. It explains history but does not prove a current fault.
Verified	A repair or change was confirmed by reading the result back.

Raw output and the readable report

Raw output keeps the technical evidence with original line numbers so you can trace any finding back to its source. The Readable report summarizes the same run in plain language, with the next safe step first.

Saved logs

KillerBench can also read saved Windows logs, such as CBS and Setup logs, without running anything on the machine. Findings link to the exact line that produced them. Load sample in Session sources opens a synthetic example you can explore safely.

Exporting

Export report saves the report with its source paths, parsed entries and evidence excerpts, for review before attaching it to a ticket. Exported reports include this computer's name, and raw logs and evidence excerpts can also contain accounts, paths or sensitive source text. Guarded collectors restrict what they retain, but imported evidence is not guaranteed to be redacted. Inspect and remove sensitive information before sharing.

killerbench-cli runs the same Engine as the desktop app from PowerShell or a remote console. Every command that could change the machine previews by default and needs an explicit flag such as --execute before it acts. Commands print JSON evidence to standard output and progress to standard error.

Step-by-step guides: Run KillerBench from scripts.

Exit code 0 means the preview or verified result succeeded, 1 means a startup, input or journal error, 2 means the arguments were not recognized, 3 means blocked, failed or unverified, 4 means a workflow needs a restart before it can verify, and 130 means you stopped it.

Run killerbench-cli with no arguments to print this list on your own machine.

Updates and servicing

• bits-job-review JOB_GUID [--all-users] [--observe]: Exact transfer review or two-snapshot observation; no retry.
• bits-jobs [--all-users]: BITS job states, owners and byte counts; no transfer changes.
• bits-retry JOB_GUID [--execute]: Preview by default; explicit exact-job retry, no application-completion claim.
• bits-retry-recover JOB_GUID: Two read-only snapshots; archives stable outcomes without another retry.
• component-repair-source: Managed DISM repair-source policy and conflicts; no changes.
• delivery-optimization: Read-only Delivery Optimization service state; JSON evidence.
• delivery-optimization-activity: Privacy-bounded current job counts and byte totals; no transfer identities or changes.
• delivery-optimization-policy: Read-only classic and Policy CSP settings; sensitive values and provider identities excluded.
• feature-service-events: Read exact Time, Search, WMI, Event Log and audio service failure history.
• feature-update-policy: Read-only target release, deferral, pause and safeguard policy; JSON evidence.
• pending-file-operations: Read-only privacy-bounded pending file operation summary; JSON evidence.
• restart-check: Read-only pending restart sources; JSON evidence.
• servicing-logs: Bounded newest CBS, plain-text and compressed CBS archives, DISM and Windows Setup log analysis; no repair.
• servicing-monitor [--refresh 1..60] [--samples 1..120] [--skip-events] [--skip-history] [--skip-services] [--skip-restart] [--skip-setup] [--skip-compatibility] [--skip-readiness] [--skip-transfers] [--skip-delivery-optimization] [--skip-installer] [--skip-scheduled-task]: Read-only Servicing activity snapshots.
• servicing-service-events: Read-only exact Windows Update servicing-chain failure histories.
• servicing-service-states: Read-only current state for the six-service Windows Update servicing chain.
• setup-code DECIMAL_OR_0xHEX: Documented Windows Setup result-code reference; no machine inspection or repair.
• update-applicability: Read-only Windows edition, build and architecture evidence.
• update-cache: Bounded read-only SoftwareDistribution cache totals; no filenames.
• update-code DECIMAL_OR_0xHEX: Documented Windows Update result-code reference; no machine inspection or repair.
• update-context: Read-only current elevation and desktop-session evidence; no account identifiers.
• update-engine-files: Read-only native Windows Update engine presence, version and signature evidence.
• update-events: Read-only Windows Update Client history from the last seven days; JSON including raw evidence.
• update-followup DECIMAL_OR_0xHEX: Fresh read-only diagnostics selected by a documented Windows Update result code.
• update-history: Read-only newest 100 Windows Update operation outcomes; JSON evidence.
• update-plan --select GUID:REVISION [--drivers] [--no-software] [--allow-restart-required] [--json] [--execute]: Repeat --select; preview by default.
• update-policy: Read-only managed Windows Update policy; JSON evidence.
• update-policy-surfaces: Read-only classic and Policy CSP configuration-surface evidence; values and provider identities excluded.
• update-recover: Check a pending update; never installs or retries it.
• update-restart-policy: Read-only compliance deadlines, grace periods, restart suppression and notification behavior.
• update-search [--drivers] [--no-software] [--filter TITLE] [--downloaded-only] [--classification GUID] [--product GUID]: JSON discovery and matches; no installation.
• update-service-events: Read-only exact Windows Update service failure history.
• update-service-files: Read-only exact Windows Update service DLL registration and signature evidence.
• update-services: Read-only Windows Update service registrations; JSON evidence.
• update-store-reset [--source Configured|WindowsUpdate|MicrosoftUpdate] [--drivers] [--no-software] [--execute]: Fresh-search gated; preview by default; retains the old store.
• update-store-reset-recover: Reconcile a prepared store reset without repeating it.
• windows-capabilities: Read-only online Windows capability states; JSON result.
• windows-update-task: Read-only exact Scheduled Start task state and runtime history; no task execution or update operation.

BitLocker and TPM

• bitlocker-auto-unlock DRIVE: [--execute]: Preview by default; turns on auto-unlock for an encrypted data volume.
• bitlocker-auto-unlock-recover: Verify an interrupted auto-unlock request without repeating it.
• bitlocker-backup DRIVE: PROTECTOR_GUID FILE_PATH [--execute]: Preview by default; new recovery backup file only.
• bitlocker-backup-recover DRIVE: PROTECTOR_GUID FILE_PATH: Verify an interrupted backup without writing it again.
• bitlocker-decrypt DRIVE: [--execute --confirm-unprotected]: Preview by default; starts decryption, for example before re-encrypting with a required method.
• bitlocker-decrypt-recover: Verify an interrupted decryption request without repeating it.
• bitlocker-encrypt DRIVE: RECOVERY_PROTECTOR_GUID NEW_BACKUP_FILE [--encryption XtsAes128] [--used-space-only] [--execute]: Preview by default; requires existing TPM and recovery protectors.
• bitlocker-encrypt-recover: Verify pending conversion state without repeating the request.
• bitlocker-escrow DRIVE: RECOVERY_PROTECTOR_GUID ad|entra [--execute]: Preview by default; backs up an existing recovery password to Active Directory or Microsoft Entra ID.
• bitlocker-plan --volume C: --operation Encrypt --encryption XtsAes256 --backup EntraId: Options preview only.
• bitlocker-protector-add DRIVE: tpm|recovery [--execute]: Preview by default; adds one TPM or recovery-password protector; the password is never printed.
• bitlocker-protector-recover: Verify an interrupted protector request without repeating it.
• bitlocker-protectors DRIVE:: Protector identities and types only; no recovery passwords.
• bitlocker-resume DRIVE: [--execute]: Preview by default; exact fully encrypted suspended volume only.
• bitlocker-resume-recover: Verify pending protection state without repeating the request.

Security and privacy

• certificate-chains: Read-only local cache-only chain trust for personal certificates; no revocation or downloads.
• defender-overview [--report]: Read-only protection, scan timing and aggregate threat overview; no action.
• defender-protection [--report]: Read-only protection preferences and recognized policy surfaces; sensitive details excluded; no changes.
• defender-scan Quick|Full [--execute] [--report]: Preview by default; one explicit guarded Microsoft Defender scan.
• defender-scan-history [--report]: Read-only quick and full scan timing and overdue status; sensitive details excluded; no scan.
• defender-scan-recover [--report]: Read-only reconciliation without starting another scan.
• defender-threats [--report]: Aggregate threat history, current active flags and severity IDs; sensitive details excluded; no action.
• firewall-enable --profile Domain|Private|Public [--profile ...] [--execute]: Preview by default; unmanaged local profiles only.
• firewall-enable-recover: Inspect a pending change without repeating it.
• firewall-events: Read bounded Windows Firewall warning, error and critical operational history.
• firewall-logging: Read Domain, Private and Public traffic logging configuration without opening logs.
• firewall-rules: Read privacy-bounded effective rule and policy-source counts.
• firewall-service-events: Read exact BFE and Windows Defender Firewall Service Control Manager failure history.
• privacy-clipboard-history on|off [--execute]: Preview by default; exact current-user value with policy preservation.
• privacy-clipboard-history-recover: Recheck an interrupted change without repeating it.
• privacy-clipboard-history-undo VERIFIED_JOURNAL [--execute]: Guarded restoration of the prior value.
• privacy-plan --select Camera --select ClipboardSync: Review selections only; no settings changed.
• privacy-setting KEY on|off [--execute]: Preview by default; policy-preserving current-user change; invalid keys list supported choices.
• privacy-setting-recover KEY: Recheck an interrupted change without repeating it.
• privacy-setting-undo KEY VERIFIED_JOURNAL [--execute]: Guarded exact-value restoration.
• security-check: Read-only TPM, Secure Boot, virtualization protections and UAC policy; JSON evidence.

Services

• service-binaries: Read-only local service binary presence and Authenticode status; paths excluded and nonlocal paths not contacted.
• service-check NAME [NAME ...] | service-check --all: Read-only supported service states and dependency evidence.
• service-dependencies: Read-only direct dependency integrity review; no service changes.
• service-dlls: Read-only registered service DLL presence and Authenticode status; paths excluded and nonlocal paths not contacted.
• service-events: Read-only service failure history; JSON including raw evidence.
• time-events: Read-only recent Windows Time event history with JSON evidence.
• service-logons: Read-only service account-class and desktop-interaction review; account identities excluded.
• service-path-quoting: Read-only service executable path quoting review; full paths and arguments excluded.
• service-recovery-policy: Read-only installed-service recovery action summary; commands and reboot messages excluded.
• service-startup-config: Read-only startup-mode coherence review; no service changes.
• service-transitions: Read-only repeated observation of pending service states; no service action.
• service-triggers: Read-only installed-service trigger summary; trigger payloads excluded; no changes.

Storage, files and backup

• backup-events: VSS and volsnap history; JSON evidence; no changes.
• backup-service-events: Read exact VSS, software shadow provider, Windows Backup and block-level engine failure history.
• backup-summary: Local Windows Backup operation summary; no backup changes.
• cleanup --user-temp [--windows-temp] [--system-temp] [--shader-caches] [--browser-caches] [--office-caches] [--thumbnail-cache] [--icon-cache] [--error-reports] [--crash-dumps] [--windows-minidumps] [--delivery-optimization-cache] [--recycle-bin] [--days 7] [--max-files 100] [--json] [--execute]: Preview by default; Recycle Bin is all-or-nothing and age does not apply.
• disk-cleanup-task: Read-only exact task state and runtime history; no task execution or cleanup.
• disk-diagnostic: Correlate exact disk diagnostic tasks and event history; no task or disk action.
• disk-diagnostic-tasks: Read-only exact collector and resolver task history; no task or disk action.
• disk-quotas: Read-only per-volume quota defaults and state; user identities excluded; no changes.
• file-history-events: Privacy-projected File History warning and error counts; no changes.
• file-history-status: Current-account File History protection state; no changes.
• search-index-rebuild [--execute]: Preview by default; retains the prior index and verifies fresh state.
• search-index-rebuild-recover: Read-only reconciliation without repeating repair commands.
• storage-check DRIVE_LETTER: Read-only fixed NTFS check; JSON results and live progress.
• storage-events: Read-only storage history; JSON including raw evidence.
• storage-jobs: Read-only aggregate Storage module job state and progress; JSON; no changes.
• storage-reliability: Read-only temperature, wear and I/O counters; JSON; no repair.
• storage-repair DRIVE: SpotFix|OfflineScanAndFix [--allow-dismount] [--backup-confirmed] [--execute]: Preview by default; execution requires backup confirmation; system volumes schedule at restart.
• storage-repair-plan DRIVE: SpotFix|OfflineScanAndFix [--allow-dismount]: Preview only; no repair or scheduling.
• storage-repair-recover: Verify a completed or scheduled filesystem repair without repeating it.
• storage-repair-review DRIVE: SpotFix|OfflineScanAndFix [--allow-dismount]: Collect and bind current evidence; no repair or scheduling.
• storage-sense-policy: Read-only recognized machine cleanup policy; user settings and file identities excluded.
• storage-sense-task: Read-only exact task state and runtime history; no task execution or cleanup.
• storage-service-events: Read exact Storage Service, Optimize Drives, VSS and software shadow provider failure history.
• volume-capacity DRIVE:: Read-only available space with JSON evidence.
• volume-dirty DRIVE:: Read-only dirty-bit status; no repair or restart.
• volume-optimize DRIVE: [Recommended|ReTrim|Defragment] [--execute]: Read-only analysis by default; exact healthy volume and compatible media required.
• volume-optimize-recover: Verify a pending completed operation without repeating it.
• vss-providers: Read-only VSS provider names, versions and types; identifiers excluded; no registration changes.
• vss-writers: Reported writer states; English output interpretation; no reset.

Printing

• print-events: Read-only PrintService Admin history from the last seven days; JSON evidence.
• print-extension-files: Read-only print processor and monitor binary presence and signature summary; full paths excluded.
• print-job-cancel QUEUE JOB_ID [--execute] [--folder PATH]: Preview by default; exact Error or Blocked job only.
• print-job-cancel-recover [--folder PATH]: Recheck an interrupted cancellation without repeating it.
• print-job-list: List current visible jobs without changing them.
• print-operational-events: Read-only PrintService Operational channel state and available history; JSON evidence.
• print-policy: Read-only Point and Print restrictions and driver-installation policy; JSON evidence.
• print-rendering-policy: Read-only rendering and driver-isolation policy; JSON evidence.
• print-spooler-events: Read-only Service Control Manager failures tied to the local Print Spooler identity; JSON evidence.
• printer-check --queue NAME [--queue NAME ...]: Read-only selected local queue settings.
• printer-conditions: Read-only local queue condition codes; no physical verification or changes.
• printer-driver-files: Read-only registered file presence and executable signature summary; full paths excluded.
• printer-driver-models: Read-only version 3, version 4 and package-awareness summary; JSON evidence.
• printer-drivers: Read-only queue and driver registration inventory and matching; JSON evidence.
• printer-endpoint-check: Bounded connections to exact assigned Standard TCP/IP printer endpoints; no discovery, SNMP or print data.
• printer-list: Discover local queues without changing settings.
• printer-ports: Read-only queue/port registration matching; JSON evidence.
• printer-queue-attributes: Read-only local queue spooling, retention and sharing attributes.
• printer-repair --queue NAME [--queue NAME ...] [--execute]: Preview by default; clearing offline mode can release waiting jobs.

Network

• dhcp-check: Read-only missing or expired DHCP lease eligibility; JSON evidence, no renewal.
• dhcp-events: Read-only IPv4 and IPv6 DHCP Client event history; JSON result.
• dhcp-leases: Read-only lease timestamp, expiry and server evidence; JSON result.
• dhcp-renew [--execute]: Preview by default; exact missing or expired connected physical DHCP leases only.
• dhcp-renew-recover: Read-only reconciliation without requesting another lease.
• dns-cache HOST [--execute]: Preview by default; guarded local cache flush with exact-host verification.
• dns-cache-recover: Recheck an interrupted cache operation without repeating the flush.
• dns-cache-summary: Privacy-bounded local DNS cache status and record-type counts; no changes.
• dns-check HOST [--timeout-seconds 1..60]: Bounded system name resolution; JSON result.
• dns-client-config: Read-only suffix, registration, devolution and policy evidence; JSON result.
• dns-client-events: Read-only privacy-bounded DNS Client warning and failure history; JSON result.
• dns-nrpt-policy: Read-only effective DNS namespace policy evidence; JSON result.
• ip-addresses: Read-only current IP address state, origin and conflict review; JSON evidence.
• ip-interface-config: Read-only IP interface configuration evidence; JSON result.
• network-firewall: Correlate active network assignments with matching firewall profile enablement.
• network-offload: Read-only global Windows network offload configuration; JSON result.
• network-profiles: Read-only current profile categories and connectivity classifications; network names excluded.
• network-service-events: Read exact DHCP, DNS, Workstation, NLA, Network List and IP Helper failure history.
• proxy-check: Read-only stored WinHTTP and current-account Internet proxy evidence.
• route-priority: Read-only effective default-route metric comparison; JSON evidence.
• smb-client-config: Read-only SMB signing, guest-access and transport configuration.
• smb-connections: Read-only active protocol negotiation; remote identities excluded.
• smb-server-config: Read-only SMB protocol, signing, encryption and multichannel configuration.
• smb-shares: Read-only bounded SMB share inventory; paths, permissions, sessions and accounts excluded.
• tcp-check HOST PORT [--timeout-seconds 1..60]: Bounded connection check; no application data sent.
• tcp-port-pressure: Read-only dynamic TCP ranges and aggregate local-port usage; endpoints and processes excluded.
• tcp-settings: Read-only Windows TCP template configuration evidence; JSON result.
• vpn-profiles: Read-only current-account VPN profile configuration; credentials excluded.
• winrm-listeners: Read-only WinRM listener registration summary; certificate thumbprints excluded.
• winsock-catalog: Read-only native Winsock protocol catalog structure; JSON result.
• winsock-namespaces: Read-only native Winsock namespace-provider structure; JSON result.
• winsock-provider-files: Read-only protocol provider file presence and signatures; JSON result.
• winsock-readiness: Read-only native Winsock protocol, namespace-provider and provider-file readiness; JSON results.

Apps

• app-folder-review FOLDER_NAME [--report]: Fixed-root exact folder review; no deletion.
• app-package-review FULL_NAME [--all-users]: Exact target and dependent packages; no removal.
• app-packages [--all-users]: Registered Appx/MSIX inventory only; no removal.
• browser-extensions: Chrome, Edge, Brave and Firefox extension identity review; no removal.
• debloat-review --area AREA [--area AREA ...] [--all-profiles] [--json]: Review only; no system changes.
• depot-review [application and configuration selections] [--json]: Review only; no provisioning.
• depot-verify-installer onedrive|teams|chrome|acrobat|zoom|7zip FULL_PATH: Read-only Authenticode and vendor-signer check; nothing is run.
• foxit-inventory: Read-only machine product inventory; JSON output.
• installed-apps [--current-user]: Uninstall registrations and capability flags; no removal.
• installed-apps-compare BEFORE.json AFTER.json: Saved inventory registration differences; no machine changes.
• installed-hotfixes: Read-only bounded installed Windows hotfix inventory; JSON evidence.
• installer-activity: Read-only Installer process and transaction-marker evidence; JSON evidence.
• installer-check: Read-only Installer policy and engine readiness; JSON evidence.
• installer-engine-files: Read-only required Installer file presence and Authenticode summary; JSON evidence.
• installer-events: Read-only MSI history from the last seven days; JSON evidence.
• installer-logging: Read-only Installer logging and debug policy; JSON evidence.
• installer-pending-state: Read-only pending file operation and Installer activity correlation; JSON evidence.
• installer-registration-repair [--execute]: Preview by default; exact service-registration defect only; never unregisters the engine.
• installer-registration-repair-recover: Recheck interrupted registration without repeating commands.
• installer-security-policy: Read-only Installer security and patch policy; JSON evidence.
• installer-service-events: Read-only Service Control Manager failures tied to the local Windows Installer identity; JSON evidence.
• installer-service-registration: Read-only Windows Installer service registration summary; JSON evidence.
• mace-package-plan (--onedrive|--outlook|--office|--project|--teams|--all-products) --package PACKAGE_FULL_NAME [--json]: Fresh exact eligibility preview; no removal provider.
• mace-package-recover: Freshly reconcile one interrupted app package-removal record; never repeats removal.
• mace-review (--onedrive|--outlook|--office|--project|--teams|--all-products) [--all-users] [--remove-data] [--remove-credentials] [--review-folder-restore] [--json]: Review only; no removal.
• msi-cache: Read-only registered Windows Installer cache visibility; JSON evidence.
• msi-code NONNEGATIVE_DECIMAL: Documented Windows Installer return-code reference; no machine inspection or repair.
• msi-product {PRODUCT-CODE}: Read-only exact MSI registration state; JSON evidence.
• msi-repair {PRODUCT-CODE} [--execute]: Preview by default; exact broken or bad-configuration product only.
• msi-repair-recover: Recheck an interrupted exact-product repair without repeating it.
• msi-sources: Read-only privacy-bounded registered Windows Installer source metadata; JSON evidence.
• orca-cache-reset --mode New|Classic|Both [--execute]: Preview by default; retains exact running-account caches under recovery names.
• orca-cache-reset-recover: Verify interrupted cache retention without repeating a move.
• orca-review --mode New|Classic|Both [--all-users] (--clear-caches|--reset-profile-settings|--reset-authentication|--delete-ost|--remove-add-ins|--reinstall-new-outlook) [--json]: Review only; no Outlook changes.
• startup-apps: Startup registrations and boot or logon task review; no disablement.

System

• bluetooth-company PACK_PATH DECIMAL_OR_0xHEX_ID: Exact local Bluetooth SIG assignment lookup; no network request.
• crash-config: Stored Windows dump mode and paths; no changes.
• crash-dumps: Default Windows dump-file metadata; no content analysis or changes.
• crash-events: Recent system error reports; no diagnosis or changes.
• crash-review [--knowledge PACK_PATH ...]: Up to 32 packs; combined crash, shutdown, bounded minidump structure and optional exact bug-check reference review; no changes.
• default-printer: Read-only default selection and automatic-management setting; JSON evidence.
• default-printer-set QUEUE [--execute] [--folder PATH]: Preview by default; missing or conflicting default only.
• default-printer-set-recover [--folder PATH]: Recheck an interrupted selection without repeating it.
• device-check <CATEGORY> [--knowledge PACK_PATH ...]: Read-only device evidence with optional exact driver references from up to 32 packs.
• device-code DECIMAL_OR_0xHEX: Offline Device Manager problem-code reference.
• driver-reference PACK_PATH HARDWARE_ID x86|x64|arm64 client|server BUILD: Reference candidates only.
• event-channel-enable CHANNEL [--execute]: Preview by default; enable one exact unmanaged diagnostic channel and preserve other settings.
• event-channel-enable-recover: Read-only reconciliation without repeating the enable command.
• event-channels: Read-only state, retention, size and saturation for four diagnostic channels.
• font-registrations: Read-only bounded machine and current-user registration and file-presence check.
• memory-diagnostic-results: Read-only bounded Windows Memory Diagnostic history; JSON evidence.
• minidump-analyze PATH: Bounded structural minidump metadata; no memory pages, symbols or changes.
• name-rename PROPOSED_NAME [--execute]: Preview by default; standalone workgroup PCs only; never restarts Windows.
• name-rename-recover: Verify a pending rename without repeating it.
• name-review PROPOSED_NAME: Read-only identity and proposed-name review.
• profiles --recover: Verify recorded absence and retain recovery evidence; never retries deletion.
• profiles --recover-backup: Verify and archive a pending backup artifact; never retries copying.
• profiles --select SID --backup-to NEW_DESTINATION [--execute]: Preview first; guarded native copy requires explicit execution and an absent local NTFS destination.
• profiles --select SID --create-backup-artifact DESTINATION: Compare an existing copied backup and create its fixed artifact; does not copy or remove a profile.
• profiles [--days 90] [--dependencies] [--select SID ...] [--save-plan] [--verify-backup RECEIPT]: Read-only review; verification requires one selected SID.
• task-check: Read-only task inventory, classified findings and JSON evidence.
• task-definition TASK_FOLDER TASK_NAME: Read-only exact task XML; unavailable does not mean absent.
• task-inventory: Read-only task identities and states; JSON output.
• task-journal RECORD.json [--completion COMPLETION.json]: Historical recovery review; never authorizes retry.
• task-plan PLAN.json [--check-conflicts] [--inspect-executable] [--resolve-account] [--inspect-signature]: Validate and review a task draft; no registration.
• task-register PLAN.json YYYY-MM-DD [--execute] [--report OUTPUT.html|OUTPUT.txt]: Preview by default; disabled create-only Local System definition.
• task-register-recover PLAN.json [--report OUTPUT.html|OUTPUT.txt]: Read-only exact-definition reconciliation; never retries or runs a task.
• task-xml PLAN.json YYYY-MM-DD: Disabled review XML to stdout; local-zone calendar schedules only; no registration.
• time-config: Read-only Windows Time mode, peers and policy evidence.
• time-configure --source DomainHierarchy|CustomPeers [--peer HOST ...] [--execute]: Preview by default; custom mode requires peers.
• time-plan [--source Existing|DomainHierarchy|CustomPeers] [--peer HOST ...]: Preview only.
• time-recover --folder PATH: Verify and archive a pending record; never retry changes.
• time-verify --source DomainHierarchy|CustomPeers [--peer HOST ...]: Read-only; custom mode requires peers.
• wmi-provider: Read-only local operating-system provider query; JSON evidence.

Knowledge, validation and engine

• knowledge PACK_PATH CONTEXT CODE: Local reference lookup; no repair execution.
• knowledge-activate PAYLOAD_JSON SIGNATURE_FILE PUBLIC_KEY_FILE PACK_ID MINIMUM_REVISION STORAGE_DIRECTORY: Verified local activation; no download.
• knowledge-active STORAGE_DIRECTORY PUBLIC_KEY_FILE PACK_ID MINIMUM_REVISION: Verify active local pack; no changes.
• knowledge-compare BEFORE_JSON AFTER_JSON: Reference changes only; no pack installation.
• knowledge-info PACK_PATH: Pack metadata and per-context entry counts; no changes.
• knowledge-log PACK_PATH CONTEXT LOG_PATH: Attach contextual references to observed codes.
• knowledge-recover STORAGE_DIRECTORY PUBLIC_KEY_FILE PACK_ID MINIMUM_REVISION: Select newest verified retained pack; no download.
• knowledge-search PACK_PATH CONTEXT TEXT: Up to 50 reference text matches; no repair execution.
• knowledge-set CONTEXT CODE PACK_PATH [PACK_PATH ...]: Resolve one exact identity across up to 32 packs; conflicts are never selected.
• knowledge-status CONFIG_JSON STORAGE_ROOT: Verify every configured installed database; no download or activation.
• knowledge-update CONFIG_JSON STORAGE_ROOT: Fetch and atomically activate signed database candidates from configured HTTPS endpoints.
• open <file.kbench> [--json]: Reopen a saved capture and evaluate it again with the installed rules.
• scan --output <new-file.kbench> [--json]: Read-only Windows Update capture saved to a new file.
• validation-coverage RECORD.json [...]: Summarize current-version native VM evidence; no diagnostics or repairs.
• validation-plan [--recipe RECIPE_ID | --workflow WORKFLOW]: Read-only disposable-VM scenario plan; no diagnostics or repairs.
• validation-record RECORD.json: Validate one bounded native VM evidence record; no diagnostics or repairs.
• validation-report OUTPUT.html|OUTPUT.txt RECORD.json [...] [--theme THEME] [--accent ACCENT] [--overwrite]: Local current-version VM coverage report.
• workflow WORKFLOW --set KEY=VALUE [--set KEY=VALUE ...] [--report OUTPUT.html|OUTPUT.txt] [--json]: Run a validated read-only shared option plan.
• workflow app-packages [--all-users] [--include-provisioned] [--json]: Inventory only.
• workflow common-problems --scope NAME [--scope NAME ...] [--report OUTPUT.html|OUTPUT.txt] [--json]: Focused diagnostic journal; no repairs.
• workflow computer-name --name PROPOSED_NAME [--json]: Journaled review only.
• workflow installer [--product-code {PRODUCT-CODE}] [--auto-repair] [--json]: Optional exact product state included in the journal.
• workflow network [--host HOST] [--tcp HOST PORT] [--auto-repair] [--json]: Optional selected-target diagnosis included in the journal.
• workflow storage [--volume D:] [--json]: Journaled read-only filesystem check.
• workflow-journal FILE.json: Historical contents; exit 0 means read successfully, not healthy.
• workflow-options [WORKFLOW [--set KEY=VALUE ...]]: Show or validate host-neutral controls; no scan or repair.
• workflow-report JOURNAL.json OUTPUT.html|OUTPUT.txt [--include-repairs] [--theme THEME] [--accent ACCENT] [--overwrite]: Historical report only; no commands run.

Other commands

• <analyze|investigate> <text-log-path> [--json]: Analyze local text evidence.
• adapter-bindings: Read-only core protocol binding summary; JSON evidence.
• adapter-statistics: Read-only adapter byte, error and discard counters; JSON evidence.
• application-events: Read-only recent Application errors, grouped counts and JSON evidence.
• applocker-policy: Read-only effective collection modes and aggregate rule counts; rule details excluded; no changes.
• common-check [--scope NAME ...]: All diagnostic areas by default; selected areas only when specified; read-only JSON.
• delete-notifications: Read-only NTFS and ReFS delete-notification configuration; JSON; no optimization or setting change.
• diagnostic-scopes [--all]: List 11 recommended outcome groups, or all 49 read-only areas; no collection.
• full-scan --scope NAME [--scope NAME ...] [--report OUTPUT.html|OUTPUT.txt] [--json]: Focused diagnostic journal; no repairs.
• full-scan [--recipes ID[,ID]] [--report OUTPUT.html|OUTPUT.txt] [--json]: All diagnostic areas; diagnostic-only, no repairs.
• gateway-check: Bounded ICMP checks of exact configured default next hops; no address scan.
• infrastructure-service-events: Read one bounded exact connectivity, remote-management, notification and core service failure snapshot.
• investigate-batch FILE [FILE ...]: Up to 12 files; JSON Lines; exit 3 for failed or partial imports.
• licensing-check: Read-only Windows activation state without product keys; JSON evidence.
• mac-vendor PACK_PATH MAC_ADDRESS: Longest-prefix local pack lookup; no network request.
• ncsi-policy: Read-only Windows connectivity classification policy; probe destinations excluded.
• neighbor-cache: Read-only privacy-bounded neighbor reachability evidence; JSON result.
• ntfs-self-healing DRIVE:: Read-only selected-volume online NTFS repair configuration; no repair or setting change.
• pagefile-check: Read-only page-file management, allocation and usage summary; full paths excluded.
• pci-vendor PACK_PATH PCI_HARDWARE_ID: Exact local pack lookup; no network request or driver selection.
• physical-disks: Read-only current health, operational, media, bus and usage state; JSON; no repair.
• platform-service-events: Read one bounded exact application, identity, profile and device-support service failure snapshot.
• previous-windows [--execute --backup-confirmed]: Preview by default; permanently removes Windows rollback capability through DISM.
• previous-windows-recover: Read-only reconciliation without repeating rollback removal.
• provisioned-packages: Packages staged for new users in local Windows; no removal.
• recipes [WORKFLOW]: List installed definitions or workflow-specific dependencies and limits; no execution.
• repair <dism|sfc> [--execute]: Preview by default.
• reserved-storage: Read-only online Windows reserved-storage state; JSON evidence.
• restore-point DESCRIPTION [ModifySettings|ApplicationInstall|DeviceDriverInstall] [--execute]: Preview by default; creates one point after fresh checks.
• restore-point-recover: Verify a pending request without creating another point.
• schedule-preview daily|weekly|monthly YYYY-MM-DD HH:mm TIME_ZONE_ID [Mon,Tue|1,15|last]: Preview only.
• shadow-copies: Read-only current VSS snapshot states and attributes; identities excluded; no snapshot changes.
• shadow-storage: Read-only VSS differential-area allocation and pressure; JSON; no resize or snapshot action.
• uac-policy: Read-only UAC enablement and elevation-prompt policy; no account or credential data.
• uefi-vendor PACK_PATH PNP|ACPI VENDOR_ID: Exact local UEFI registry lookup; no network request or driver selection.
• usb-vendor PACK_PATH USB_HARDWARE_ID: Exact local pack lookup; no network request or driver selection.
• vitals-check: Read-only Windows, hardware, account, resource, battery and physical-disk snapshots; JSON evidence.
• win32-code DECIMAL_OR_0xHEX: Offline installed-Windows message lookup.
• workflows: List installed workflow keys and titles; no scan or repair.

An action says it is blocked

A blocked result means the requested action could not proceed. Read the message and journal to see whether it stopped before dispatch or after an earlier step. Do not assume a partially completed operation was rolled back. The most common prerequisite reasons are below.

• Administrator access is required. Close KillerBench and start it again with Run as administrator.
• Restart readiness must be clear. Windows has a restart pending. Restart the computer, then run the action again.
• Managed policy is present. Group policy or device management owns the setting. Change it there instead.
• Evidence changed. Something changed between the first check and the final recheck. Run the tool again to read the new state.

A previous request needs reconciliation

KillerBench found a pending record from an interrupted request. Run the same action again. It checks what happened and reports the real outcome without repeating the request. On the command line, use the matching -recover command, for example killerbench-cli bitlocker-auto-unlock-recover.

A check shows Incomplete or Unknown

The evidence could not be read, often because KillerBench was not running as administrator or a Windows service was unavailable. KillerBench reports this honestly instead of assuming the computer is healthy.

Where files are kept

Journals, pending records and saved evidence live under %LOCALAPPDATA%\KillerBench. Each guarded action keeps its own folder. Keep them when you need a record of what changed.

Reporting a problem

KillerBench is in development. Include the exported report and the activity log when you report a problem, and remove anything you would not share.