Automated System Diagnostics Collector Batch Script
This comprehensive batch file integrates with Sysinternals tools to collect critical system information about running applications, network connections, and RDP sessions. The script creates a timestamped report that helps with troubleshooting, security audits, and system analysis.
Complete Batch Script (SystemDiagnosticsCollector.bat)
Select all, copy & paste in Notepad as a.bat files
@echo off
SETLOCAL EnableDelayedExpansion
:: #######################################################
:: # Automated System Diagnostics Collector
:: # Version 2.1 – Integrates Sysinternals Tools
:: # Collects: Running apps, network connections, RDP info
:: # Output: HTML report with timestamp
:: #######################################################
:: Configuration Section
set “REPORT_FOLDER=%USERPROFILE%\Desktop\SystemReports”
set “SYSINTERNALS_DIR=C:\Sysinternals”
set “REPORT_FILE=%REPORT_FOLDER%\SystemReport_%date:~-4,4%-%date:~-7,2%-%date:~-10,2%_%time:~0,2%-%time:~3,2%.html”
:: Create report directory if not exists
if not exist “%REPORT_FOLDER%” mkdir “%REPORT_FOLDER%”
:: Check if Sysinternals tools are available
if not exist “%SYSINTERNALS_DIR%\Autoruns.exe” (
echo Sysinternals tools not found in %SYSINTERNALS_DIR%
echo Download from: https://learn.microsoft.com/en-us/sysinternals/
pause
exit /b
)
:: Start HTML Report
echo ^<html^>^<head^>^<title^>System Diagnostics Report^</title^>^</head^>^<body^> > “%REPORT_FILE%”
echo ^<h1^>System Diagnostics Report^</h1^> >> “%REPORT_FILE%”
echo ^<p^>Generated on: %date% %time%^</p^> >> “%REPORT_FILE%”
echo ^<hr^> >> “%REPORT_FILE%”
:: 1. System Information
echo ^<h2^>1. System Information^</h2^> >> “%REPORT_FILE%”
systeminfo >> “%REPORT_FILE%.tmp”
call :FormatTextToHTML “%REPORT_FILE%.tmp” “%REPORT_FILE%”
:: 2. Running Processes (Tasklist)
echo ^<h2^>2. Running Processes^</h2^> >> “%REPORT_FILE%”
tasklist /v >> “%REPORT_FILE%.tmp”
call :FormatTextToHTML “%REPORT_FILE%.tmp” “%REPORT_FILE%”
:: 3. Network Connections (Netstat)
echo ^<h2^>3. Network Connections^</h2^> >> “%REPORT_FILE%”
netstat -ano >> “%REPORT_FILE%.tmp”
call :FormatTextToHTML “%REPORT_FILE%.tmp” “%REPORT_FILE%”
:: 4. TCPView Alternative (Sysinternals)
echo ^<h2^>4. Detailed Network Connections (TCPView)^</h2^> >> “%REPORT_FILE%”
“%SYSINTERNALS_DIR%\Tcpview.exe” /accepteula /s “%REPORT_FOLDER%\tcpview.csv”
powershell -command “Import-Csv ‘%REPORT_FOLDER%\tcpview.csv’ | ConvertTo-Html -Fragment” >> “%REPORT_FILE%”
:: 5. Startup Programs (Autoruns)
echo ^<h2^>5. Startup Programs (Autoruns)^</h2^> >> “%REPORT_FILE%”
“%SYSINTERNALS_DIR%\Autoruns.exe” /accepteula -a -h -s “%REPORT_FOLDER%\autoruns.csv”
powershell -command “Import-Csv ‘%REPORT_FOLDER%\autoruns.csv’ | ConvertTo-Html -Fragment” >> “%REPORT_FILE%”
:: 6. RDP Sessions (Query)
echo ^<h2^>6. Active RDP Sessions^</h2^> >> “%REPORT_FILE%”
query session >> “%REPORT_FILE%.tmp”
call : FormatTextToHTML “%REPORT_FILE%.tmp” “%REPORT_FILE%”
:: 7. Installed Applications
echo ^<h2^>7. Installed Applications^</h2^> >> “%REPORT_FILE%”
wmic product get name,version >> “%REPORT_FILE%.tmp”
call :FormatTextToHTML “%REPORT_FILE%.tmp” “%REPORT_FILE%”
:: Close HTML
echo ^</body^>^</html^> >> “%REPORT_FILE%”
:: Cleanup
del “%REPORT_FILE%.tmp” 2>nul
del “%REPORT_FOLDER%\tcpview.csv” 2>nul
del “%REPORT_FOLDER%\autoruns.csv” 2>nul
:: Open report
start “” “%REPORT_FILE%”
echo Report generated successfully: %REPORT_FILE%
pause
exit /b
:: #######################################################
:: # Functions
:: #######################################################
:FormatTextToHTML
set “input=%~1”
set “output=%~2”
powershell -command “Get-Content ‘%input%’ | ConvertTo-Html -Fragment >> ‘%output%'”
goto :eof
How to Use This Script
-
Download Sysinternals Suite from Microsoft and extract to
C:\Sysinternals -
Save the script as
SystemDiagnosticsCollector.bat -
Run as Administrator (required for some system information)
-
View the report (HTML file on your desktop)
Command Breakdown and Benefits
1. System Information (systeminfo)
-
What it collects: OS version, hotfixes, network cards, memory
-
Benefit: Baseline system configuration for comparison
-
Security use: Identify missing security patches
2. Running Processes (tasklist /v)
-
What it collects: All active processes with details
-
Benefit: Spot suspicious executables
-
Example: Detect crypto-mining malware
3. Network Connections (netstat -ano)
-
What it collects: Active connections with process IDs
-
Benefit: Identify unexpected external connections
-
Security use: Find C2 (Command & Control) servers
4. TCPView Alternative
-
What it collects: Detailed process-to-connection mapping
-
Benefit: More readable than netstat
-
Example: Spot hidden backdoors
5. Startup Programs (Autoruns)
-
What it collects: All auto-start locations
-
Benefit: Find persistence mechanisms
-
Security use: Detect registry-based malware
6. RDP Sessions (query session)
-
What it collects: Active remote desktop sessions
-
Benefit: Monitor unauthorized access
-
Example: Detect brute force attempts
7. Installed Applications (wmic product)
-
What it collects: All installed programs
-
Benefit: Inventory software assets
-
Security use: Find vulnerable applications
Advanced Customization Options
Add Malware Scanning
Insert before the cleanup section:
:: Optional: Malware Scan with Windows Defender
echo ^<h2^>8. Quick Malware Scan^</h2^> >> “%REPORT_FILE%”
powershell -command “Start-MpScan -ScanType QuickScan | ConvertTo-Html -Fragment” >> “%REPORT_FILE%”
Email the Report Automatically
Add this (requires PowerShell mail setup):
:: Email the report
powershell -command “Send-MailMessage -From ‘diagnostics@yourdomain.com’ -To ‘admin@yourdomain.com’ -Subject ‘System Diagnostics Report’ -Body ‘Attached report’ -Attachments ‘%REPORT_FILE%’ -SmtpServer ‘smtp.yourdomain.com'”
Security Considerations
-
Store reports securely – They contain sensitive system information
-
Regularly update Sysinternals tools – Get latest detection capabilities
-
Modify for your environment – Adjust paths and collected data as needed
-
Consider encryption – For highly sensitive environments
Alternative Tools
If you need more advanced capabilities:
1. Process Explorer (Sysinternals)
-
Better than: Tasklist
-
Benefits: Tree view of processes, color-coded risks
2. NirSoft’s NetworkOpenedFiles
-
Better than: Basic netstat
-
Benefits: Shows files opened over network
3. Belarc Advisor
-
Better than: WMIC for software inventory
-
Benefits: Detailed security audit
Conclusion
This automated diagnostics script provides:
-
Comprehensive system snapshot in one click
-
Security audit capabilities for malware detection
-
Network connection analysis to spot intrusions
-
Professional HTML report for documentation
Pro Tip: Schedule this to run weekly and compare reports for changes using fc (file compare) command!
Recent Post
