From 508e55dac4a72dc7b25bfd4876c28ec69e24f8e8 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Sat, 9 May 2026 14:56:57 -0500
Subject: [PATCH 01/17] Add legacy driver and GlobalFlag IPU blocker detection
 to OSUpgrade Assessment script

Adds two new pre-upgrade checks to Windows_OSUpgrade_Assessment_Validation.ps1:

1. Get-LegacyDriverBlockers: Scans the Services registry for known legacy
   VMware/ghost hardware drivers (vmmouse, vm3dmp, flpydisk, vmhgfs, vmrawdsk,
   vmusbmouse, vmvss, vmscsi, vmxnet) that are set to load (Start <= 3).
   These drivers cause IPU to fail with 0xC1900101-0x50016 when Windows Setup
   boots into SafeOS and encounters hardware unsupported by the Azure Hyper-V host.

2. Get-GlobalFlagStatus: Detects GlobalFlag enabled in Session Manager
   (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager). When set, this
   forces Windows Setup into PageHeap/debug mode, throttling memory operations
   and causing IPU to time out and roll back.

Both checks output [Failed] checklist items with inline remediation guidance:
- Disable (not Uninstall) legacy devices in Device Manager before retrying IPU
- Remove GlobalFlag via reg delete and reboot before retrying IPU

Addresses scenario: lift-and-shift Azure VMs from VMware/on-premises environments.
Related ADO: #35892966

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 ...indows_OSUpgrade_Assessment_Validation.ps1 | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1 b/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
index 00618c3..570c5a7 100644
--- a/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
+++ b/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
@@ -33,6 +33,30 @@ Disclaimer:
     PS> .\Windows_OSUpgrade_Assessment_Validation.ps1
 #>
 
+# ---- Legacy driver and GlobalFlag detection ----------------------------------
+function Get-LegacyDriverBlockers {
+    # Known legacy VMware / ghost hardware drivers that cause 0xC1900101-0x50016
+    $knownBlockers = @('vmmouse', 'vm3dmp', 'flpydisk', 'vmhgfs', 'vmrawdsk', 'vmusbmouse', 'vmvss', 'vmscsi', 'vmxnet')
+    $found = @()
+    foreach ($name in $knownBlockers) {
+        $svcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$name"
+        if (Test-Path $svcPath) {
+            $start = (Get-ItemProperty $svcPath -ErrorAction SilentlyContinue).Start
+            # Start values: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled
+            if ($null -ne $start -and $start -le 3) {
+                $found += $name
+            }
+        }
+    }
+    return $found
+}
+
+function Get-GlobalFlagStatus {
+    $smPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager"
+    $gf = (Get-ItemProperty $smPath -Name GlobalFlag -ErrorAction SilentlyContinue).GlobalFlag
+    return ($null -ne $gf -and $gf -ne 0)
+}
+
 # ---- Safety checks -----------------------------------------------------------
 function Assert-Admin {
     $isAdmin = ([Security.Principal.WindowsPrincipal] `
@@ -202,6 +226,10 @@ if ($isServer) {
     }
 }
 
+# --- Run legacy driver and GlobalFlag checks (server IPU blocker detection) ---
+$legacyDriverBlockers = Get-LegacyDriverBlockers
+$globalFlagEnabled    = Get-GlobalFlagStatus
+
 # --- Checklist Output ---
 $checklist = @()
 $checklist += "Windows Version: $windowsProductName"
@@ -256,6 +284,30 @@ if ($isServer) {
     }
 }
 
+# Legacy Driver / Ghost Hardware Check (IPU blocker)
+if ($legacyDriverBlockers.Count -gt 0) {
+    $checklist += "[Failed] Legacy IPU-blocking drivers detected: $($legacyDriverBlockers -join ', ')"
+    $messages += ""
+    $messages += "FAILED: Legacy VMware/ghost hardware drivers are present and set to load. These will cause IPU to fail with error 0xC1900101-0x50016 (SafeOS boot crash)."
+    $messages += "  Drivers found: $($legacyDriverBlockers -join ', ')"
+    $messages += "  Action: In Device Manager, DISABLE (do not uninstall) each legacy device before retrying IPU."
+    $messages += "  Note: Uninstalling may allow PnP to reinstall the driver on next reboot. Disable ensures it stays dormant during upgrade."
+} else {
+    $checklist += "[Passed] No legacy IPU-blocking drivers detected"
+}
+
+# GlobalFlag (PageHeap/debug mode) Check
+if ($globalFlagEnabled) {
+    $checklist += "[Failed] GlobalFlag debug mode is enabled (causes throttled Setup and slow IPU rollback)"
+    $messages += ""
+    $messages += "FAILED: GlobalFlag is enabled in Session Manager. This forces Windows Setup to run in debug/PageHeap mode, causing severely throttled memory operations during IPU and a guaranteed rollback."
+    $messages += "  Action: Disable GlobalFlag before retrying IPU:"
+    $messages += '  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v GlobalFlag /f'
+    $messages += "  Then reboot the VM before attempting the in-place upgrade."
+} else {
+    $checklist += "[Passed] GlobalFlag debug mode is not enabled"
+}
+
 # Output checklist first, then messages
 $checklist | ForEach-Object { Write-Output $_ }
 $messages | ForEach-Object { Write-Output $_ }

From c7866284c8b9b46f0f46cc419149d331d0a20728 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Tue, 9 Jun 2026 14:23:29 -0500
Subject: [PATCH 02/17] Add simple offline TSS rescue wrapper and README

---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 209 ++++++++++++++++++
 .../Windows/TSSOfflineRescueWrapper/readme.md |  43 ++++
 2 files changed, 252 insertions(+)
 create mode 100644 RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
 create mode 100644 RunCommand/Windows/TSSOfflineRescueWrapper/readme.md

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
new file mode 100644
index 0000000..cbcbb5c
--- /dev/null
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -0,0 +1,209 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$OfflineWindowsRoot,
+
+    [Parameter(Mandatory = $false)]
+    [string]$OutputRoot = "C:\MS_DATA\OfflineTSSWrapper",
+
+    [Parameter(Mandatory = $false)]
+    [string]$TssPath,
+
+    [Parameter(Mandatory = $false)]
+    [string]$TssCollectLog = "DND_SetupReport",
+
+    [Parameter(Mandatory = $false)]
+    [string[]]$TssArguments,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$RunTssOnRescueVm,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$IncludeRegistryHives,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$ZipOutput,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$NoAcceptEula,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$Force
+)
+
+$ErrorActionPreference = "Stop"
+
+function Resolve-OfflineWindowsRoot {
+    param(
+        [string]$RequestedPath
+    )
+
+    if (-not [string]::IsNullOrWhiteSpace($RequestedPath)) {
+        $normalized = $RequestedPath.TrimEnd("\\")
+        if (-not (Test-Path -LiteralPath $normalized)) {
+            throw "OfflineWindowsRoot path does not exist: $normalized"
+        }
+
+        if (-not (Test-Path -LiteralPath (Join-Path $normalized "System32\config\SYSTEM"))) {
+            throw "Path does not look like a Windows directory (missing System32\\config\\SYSTEM): $normalized"
+        }
+
+        return $normalized
+    }
+
+    $drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Root -match "^[A-Z]:\\$" }
+    $candidates = New-Object System.Collections.Generic.List[string]
+
+    foreach ($drive in $drives) {
+        $candidate = Join-Path $drive.Root "Windows"
+        $systemHive = Join-Path $candidate "System32\config\SYSTEM"
+        if (Test-Path -LiteralPath $systemHive) {
+            $candidates.Add($candidate) | Out-Null
+        }
+    }
+
+    if ($candidates.Count -eq 0) {
+        throw "No offline Windows installation was auto-detected. Provide -OfflineWindowsRoot explicitly."
+    }
+
+    if ($candidates.Count -gt 1) {
+        $first = $candidates[0]
+        Write-Warning "Multiple Windows roots detected: $($candidates -join ', '). Using: $first"
+        return $first
+    }
+
+    return $candidates[0]
+}
+
+function Copy-IfPresent {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Source,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Destination
+    )
+
+    if (-not (Test-Path -LiteralPath $Source)) {
+        Write-Host "[skip] Missing: $Source" -ForegroundColor DarkYellow
+        return
+    }
+
+    $destParent = Split-Path -Parent $Destination
+    if (-not (Test-Path -LiteralPath $destParent)) {
+        New-Item -Path $destParent -ItemType Directory -Force | Out-Null
+    }
+
+    Copy-Item -LiteralPath $Source -Destination $Destination -Recurse -Force
+    Write-Host "[copy] $Source -> $Destination" -ForegroundColor DarkCyan
+}
+
+function Run-OptionalTss {
+    param(
+        [string]$Path,
+        [string[]]$Arguments,
+        [switch]$AutoAcceptEula
+    )
+
+    if (-not (Test-Path -LiteralPath $Path)) {
+        throw "TSS script not found: $Path"
+    }
+
+    $invokeArgs = New-Object System.Collections.Generic.List[string]
+    if ($Arguments) {
+        foreach ($arg in $Arguments) {
+            if (-not [string]::IsNullOrWhiteSpace($arg)) {
+                $invokeArgs.Add($arg) | Out-Null
+            }
+        }
+    }
+
+    if ($AutoAcceptEula -and -not ($invokeArgs -contains "-AcceptEula")) {
+        $invokeArgs.Add("-AcceptEula") | Out-Null
+    }
+
+    Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($invokeArgs -join " ")) -ForegroundColor Yellow
+    & $Path @invokeArgs
+    Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
+}
+
+$resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot
+$offlineRoot = Split-Path -Parent $resolvedWindowsRoot
+$timeStamp = Get-Date -Format "yyyyMMdd-HHmmss"
+$outputFolder = Join-Path $OutputRoot "offline-tss-wrapper-$timeStamp"
+
+if ((Test-Path -LiteralPath $outputFolder) -and -not $Force) {
+    throw "Output folder already exists: $outputFolder. Use -Force to overwrite."
+}
+
+New-Item -Path $outputFolder -ItemType Directory -Force | Out-Null
+
+Write-Host "Offline Windows root : $resolvedWindowsRoot" -ForegroundColor Green
+Write-Host "Offline disk root    : $offlineRoot" -ForegroundColor Green
+Write-Host "Output folder        : $outputFolder" -ForegroundColor Green
+
+# Collect a practical offline bundle aligned with Windows Update / DnD troubleshooting.
+$pathsToCollect = @(
+    @{ Rel = "Windows\System32\winevt\Logs"; Dest = "offline\winevt\Logs" },
+    @{ Rel = "Windows\Logs\CBS"; Dest = "offline\Windows\Logs\CBS" },
+    @{ Rel = "Windows\Logs\DISM"; Dest = "offline\Windows\Logs\DISM" },
+    @{ Rel = "Windows\Panther"; Dest = "offline\Windows\Panther" },
+    @{ Rel = "Windows\INF\setupapi.dev.log"; Dest = "offline\Windows\INF\setupapi.dev.log" },
+    @{ Rel = "Windows\INF\setupapi.setup.log"; Dest = "offline\Windows\INF\setupapi.setup.log" },
+    @{ Rel = "Windows\SoftwareDistribution\ReportingEvents.log"; Dest = "offline\Windows\SoftwareDistribution\ReportingEvents.log" },
+    @{ Rel = "Windows\System32\catroot2"; Dest = "offline\Windows\System32\catroot2" },
+    @{ Rel = "Windows\Minidump"; Dest = "offline\Windows\Minidump" },
+    @{ Rel = "Windows\MEMORY.DMP"; Dest = "offline\Windows\MEMORY.DMP" },
+    @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs" }
+)
+
+foreach ($item in $pathsToCollect) {
+    $sourcePath = Join-Path $offlineRoot $item.Rel
+    $destPath = Join-Path $outputFolder $item.Dest
+    Copy-IfPresent -Source $sourcePath -Destination $destPath
+}
+
+if ($IncludeRegistryHives) {
+    $hiveFolder = Join-Path $resolvedWindowsRoot "System32\config"
+    $hives = @("SYSTEM", "SOFTWARE", "SAM", "SECURITY", "DEFAULT", "COMPONENTS")
+    foreach ($hive in $hives) {
+        $sourceHive = Join-Path $hiveFolder $hive
+        $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
+        Copy-IfPresent -Source $sourceHive -Destination $destHive
+    }
+}
+
+if ($RunTssOnRescueVm) {
+    if ([string]::IsNullOrWhiteSpace($TssPath)) {
+        $candidate = Join-Path $PSScriptRoot "..\TSS\TSS.ps1"
+        if (Test-Path -LiteralPath $candidate) {
+            $TssPath = (Resolve-Path $candidate).Path
+        }
+        else {
+            throw "-RunTssOnRescueVm was set, but -TssPath was not provided and default candidate was not found: $candidate"
+        }
+    }
+
+    $effectiveTssArgs = @()
+    if ($TssArguments -and $TssArguments.Count -gt 0) {
+        $effectiveTssArgs = $TssArguments
+    }
+    else {
+        $effectiveTssArgs = @("-CollectLog", $TssCollectLog)
+    }
+
+    Run-OptionalTss -Path $TssPath -Arguments $effectiveTssArgs -AutoAcceptEula:(-not $NoAcceptEula)
+}
+
+if ($ZipOutput) {
+    $zipPath = "$outputFolder.zip"
+    if (Test-Path -LiteralPath $zipPath) {
+        Remove-Item -LiteralPath $zipPath -Force
+    }
+
+    Compress-Archive -Path (Join-Path $outputFolder "*") -DestinationPath $zipPath -CompressionLevel Optimal
+    Write-Host "Zip created: $zipPath" -ForegroundColor Green
+}
+
+Write-Host "Offline rescue collection complete." -ForegroundColor Green
+Write-Host "Bundle path: $outputFolder" -ForegroundColor Green
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
new file mode 100644
index 0000000..9cb58c0
--- /dev/null
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -0,0 +1,43 @@
+# TSS Offline Rescue Wrapper
+
+## Overview
+This script helps when the target VM cannot boot and its OS disk is attached to a rescue VM:
+- Copies offline Windows troubleshooting artifacts from the attached disk.
+- Optionally runs TSS on the rescue VM.
+- Accepts any TSS switch set using `-TssArguments`.
+- No telemetry/metadata output files are generated by this wrapper.
+
+## Files
+- `Invoke-TSSOfflineRescueWrapper.ps1`
+
+## Examples
+
+### Offline collection only
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -ZipOutput
+```
+
+### Offline collection + default TSS mode (`-CollectLog DND_SetupReport`)
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -RunTssOnRescueVm -TssPath C:\TSS\TSS.ps1
+```
+
+### Offline collection + custom TSS switches
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -RunTssOnRescueVm -TssPath C:\TSS\TSS.ps1 -TssArguments @('-SDP','Setup','-SkipSDPList','skipBPA,skipTS')
+```
+
+## Key Parameters
+- `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
+- `-OutputRoot <path>`: Root for output bundles. Default `C:\MS_DATA\OfflineTSSWrapper`.
+- `-IncludeRegistryHives`: Include SYSTEM/SOFTWARE/SAM/SECURITY/DEFAULT/COMPONENTS hives.
+- `-RunTssOnRescueVm`: Runs TSS in rescue VM context.
+- `-TssPath <path>`: Path to TSS script.
+- `-TssArguments <string[]>`: Any TSS args passed as-is.
+- `-TssCollectLog <name>`: Fallback used only if `-TssArguments` is omitted.
+- `-NoAcceptEula`: Prevent automatic `-AcceptEula` append.
+- `-ZipOutput`: Create zip after collection.
+
+## Notes
+- This does not run TSS against an offline image directly; it collects offline artifacts and can run TSS on the rescue VM itself.
+- Use elevated PowerShell on the rescue VM.

From 0113999a43c9954e29a1f6586c56c7e5e65f61c2 Mon Sep 17 00:00:00 2001
From: John Dickson <28873200+jdickson289@users.noreply.github.com>
Date: Fri, 12 Jun 2026 13:40:27 -0500
Subject: [PATCH 03/17] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../Invoke-TSSOfflineRescueWrapper.ps1                     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index cbcbb5c..a422a95 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -122,9 +122,10 @@ function Run-OptionalTss {
         $invokeArgs.Add("-AcceptEula") | Out-Null
     }
 
-    Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($invokeArgs -join " ")) -ForegroundColor Yellow
-    & $Path @invokeArgs
-    Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
+$invokeArgsArray = $invokeArgs.ToArray()
+Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($invokeArgsArray -join " ")) -ForegroundColor Yellow
+& $Path @invokeArgsArray
+Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
 }
 
 $resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot

From da3cc809d13d6a0313767793b25643123c592108 Mon Sep 17 00:00:00 2001
From: John Dickson <28873200+jdickson289@users.noreply.github.com>
Date: Fri, 12 Jun 2026 13:40:37 -0500
Subject: [PATCH 04/17] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../Invoke-TSSOfflineRescueWrapper.ps1                       | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index a422a95..6c4b599 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -131,6 +131,11 @@ Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
 $resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot
 $offlineRoot = Split-Path -Parent $resolvedWindowsRoot
 $timeStamp = Get-Date -Format "yyyyMMdd-HHmmss"
+
+if (-not (Test-Path -LiteralPath $OutputRoot)) {
+    New-Item -Path $OutputRoot -ItemType Directory -Force | Out-Null
+}
+
 $outputFolder = Join-Path $OutputRoot "offline-tss-wrapper-$timeStamp"
 
 if ((Test-Path -LiteralPath $outputFolder) -and -not $Force) {

From e011d21d81e4e1cadcf4be54d711f591755c45b3 Mon Sep 17 00:00:00 2001
From: John Dickson <28873200+jdickson289@users.noreply.github.com>
Date: Fri, 12 Jun 2026 13:41:00 -0500
Subject: [PATCH 05/17] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 39 +++++++++++--------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index 6c4b599..ed3c44d 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -51,28 +51,33 @@ function Resolve-OfflineWindowsRoot {
         return $normalized
     }
 
-    $drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Root -match "^[A-Z]:\\$" }
-    $candidates = New-Object System.Collections.Generic.List[string]
-
-    foreach ($drive in $drives) {
-        $candidate = Join-Path $drive.Root "Windows"
-        $systemHive = Join-Path $candidate "System32\config\SYSTEM"
-        if (Test-Path -LiteralPath $systemHive) {
-            $candidates.Add($candidate) | Out-Null
-        }
+$drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Root -match "^[A-Z]:\\$" }
+$candidates = New-Object System.Collections.Generic.List[string]
+$localWindows = (Resolve-Path -LiteralPath $env:windir).Path
+
+foreach ($drive in $drives) {
+    $candidate = Join-Path $drive.Root "Windows"
+    if ($candidate -ieq $localWindows) {
+        continue
     }
 
-    if ($candidates.Count -eq 0) {
-        throw "No offline Windows installation was auto-detected. Provide -OfflineWindowsRoot explicitly."
+    $systemHive = Join-Path $candidate "System32\config\SYSTEM"
+    if (Test-Path -LiteralPath $systemHive) {
+        $candidates.Add($candidate) | Out-Null
     }
+}
 
-    if ($candidates.Count -gt 1) {
-        $first = $candidates[0]
-        Write-Warning "Multiple Windows roots detected: $($candidates -join ', '). Using: $first"
-        return $first
-    }
+if ($candidates.Count -eq 0) {
+    throw "No offline Windows installation was auto-detected (local Windows is ignored). Provide -OfflineWindowsRoot explicitly."
+}
+
+if ($candidates.Count -gt 1) {
+    $first = $candidates[0]
+    Write-Warning "Multiple offline Windows roots detected: $($candidates -join ', '). Using: $first"
+    return $first
+}
 
-    return $candidates[0]
+return $candidates[0]
 }
 
 function Copy-IfPresent {

From 2a816f82d4319c543b7bee3de6ea5bddd6b24a73 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Fri, 12 Jun 2026 14:46:38 -0500
Subject: [PATCH 06/17] Handle root-level Windows path when deriving offline
 disk root

---
 .../TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index ed3c44d..ff50520 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -135,6 +135,7 @@ Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
 
 $resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot
 $offlineRoot = Split-Path -Parent $resolvedWindowsRoot
+$offlineRoot = if ([string]::IsNullOrWhiteSpace($offlineRoot)) { Split-Path -Qualifier $resolvedWindowsRoot } else { $offlineRoot }
 $timeStamp = Get-Date -Format "yyyyMMdd-HHmmss"
 
 if (-not (Test-Path -LiteralPath $OutputRoot)) {

From b91f3439395adbcb4ce5219b6ef09c25abe3cb03 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Fri, 12 Jun 2026 14:50:53 -0500
Subject: [PATCH 07/17] Continue collection when files are locked during copy

---
 .../Invoke-TSSOfflineRescueWrapper.ps1                   | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index ff50520..96f7a68 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -99,8 +99,13 @@ function Copy-IfPresent {
         New-Item -Path $destParent -ItemType Directory -Force | Out-Null
     }
 
-    Copy-Item -LiteralPath $Source -Destination $Destination -Recurse -Force
-    Write-Host "[copy] $Source -> $Destination" -ForegroundColor DarkCyan
+    try {
+        Copy-Item -LiteralPath $Source -Destination $Destination -Recurse -Force -ErrorAction Stop
+        Write-Host "[copy] $Source -> $Destination" -ForegroundColor DarkCyan
+    }
+    catch {
+        Write-Warning "[skip] Failed to copy $Source. Reason: $($_.Exception.Message)"
+    }
 }
 
 function Run-OptionalTss {

From daa06a62d16bfd71979fb2b48a6f3d84475e372e Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:01:31 -0500
Subject: [PATCH 08/17] Default TSS to -SDP Setup and fix AmbiguousParameterSet
 via hashtable splat

---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 223 +++++++++++++++---
 .../Windows/TSSOfflineRescueWrapper/readme.md |  84 +++++--
 2 files changed, 255 insertions(+), 52 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index 96f7a68..32b68ad 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -4,20 +4,17 @@ param(
     [string]$OfflineWindowsRoot,
 
     [Parameter(Mandatory = $false)]
-    [string]$OutputRoot = "C:\MS_DATA\OfflineTSSWrapper",
+    [string]$Disk,
 
     [Parameter(Mandatory = $false)]
     [string]$TssPath,
 
     [Parameter(Mandatory = $false)]
-    [string]$TssCollectLog = "DND_SetupReport",
+    [string]$TssCollectLog,
 
     [Parameter(Mandatory = $false)]
     [string[]]$TssArguments,
 
-    [Parameter(Mandatory = $false)]
-    [switch]$RunTssOnRescueVm,
-
     [Parameter(Mandatory = $false)]
     [switch]$IncludeRegistryHives,
 
@@ -33,11 +30,129 @@ param(
 
 $ErrorActionPreference = "Stop"
 
+$msDataRoot = "C:\MS_DATA"
+$outputRoot = Join-Path $msDataRoot "TSS_PERF_OFFLINE"
+
+function Ensure-DiskReady {
+    param(
+        [int]$DiskNumber
+    )
+
+    $targetDisk = Get-Disk -Number $DiskNumber -ErrorAction SilentlyContinue
+    if (-not $targetDisk) {
+        throw "Disk number '$DiskNumber' was not found."
+    }
+
+    if ($targetDisk.OperationalStatus -eq 'Offline' -or $targetDisk.IsOffline) {
+        Write-Host "[disk] Bringing disk $DiskNumber online" -ForegroundColor Yellow
+        try {
+            Set-Disk -Number $DiskNumber -IsOffline $false -ErrorAction Stop
+            Set-Disk -Number $DiskNumber -IsReadOnly $false -ErrorAction Stop
+        }
+        catch {
+            if ($_ -match 'Access Denied|40001') {
+                throw "Access denied bringing disk $DiskNumber online. The disk may be in use by another process or VM."
+            }
+            throw "Failed to bring disk $DiskNumber online: $($_.Exception.Message)"
+        }
+        Start-Sleep -Seconds 2
+        $targetDisk = Get-Disk -Number $DiskNumber -ErrorAction SilentlyContinue
+    }
+    elseif ($targetDisk.IsReadOnly) {
+        Write-Host "[disk] Clearing read-only on disk $DiskNumber" -ForegroundColor Yellow
+        try {
+            Set-Disk -Number $DiskNumber -IsReadOnly $false -ErrorAction Stop
+        }
+        catch {
+            if ($_ -match 'Access Denied|40001') {
+                throw "Access denied clearing read-only on disk $DiskNumber. The disk may be in use by another process or VM."
+            }
+            throw "Failed to clear read-only flag on disk ${DiskNumber}: $($_.Exception.Message)"
+        }
+        $targetDisk = Get-Disk -Number $DiskNumber -ErrorAction SilentlyContinue
+    }
+
+    if (-not $targetDisk -or $targetDisk.IsOffline -or $targetDisk.IsReadOnly) {
+        throw "Disk $DiskNumber is not ready (offline or read-only) after remediation attempt."
+    }
+}
+
 function Resolve-OfflineWindowsRoot {
     param(
-        [string]$RequestedPath
+        [string]$RequestedPath,
+        [string]$DiskSpecifier
     )
 
+    if (-not [string]::IsNullOrWhiteSpace($RequestedPath) -and -not [string]::IsNullOrWhiteSpace($DiskSpecifier)) {
+        throw "Use either -OfflineWindowsRoot or -Disk, not both."
+    }
+
+    if (-not [string]::IsNullOrWhiteSpace($DiskSpecifier)) {
+        $normalizedDisk = $DiskSpecifier.Trim().ToUpperInvariant()
+
+        if ($normalizedDisk -match "^\d+$") {
+            $diskNumber = [int]$normalizedDisk
+            Ensure-DiskReady -DiskNumber $diskNumber
+
+            $volumes = @(Get-Partition -DiskNumber $diskNumber -ErrorAction SilentlyContinue |
+                Get-Volume -ErrorAction SilentlyContinue |
+                Where-Object { -not [string]::IsNullOrWhiteSpace($_.DriveLetter) })
+
+            if ($volumes.Count -eq 0) {
+                throw "Disk number '$diskNumber' has no mounted volume with a drive letter."
+            }
+
+            $candidates = @()
+            foreach ($volume in $volumes) {
+                $candidate = "$($volume.DriveLetter):\Windows"
+                if (Test-Path -LiteralPath (Join-Path $candidate "System32\config\SYSTEM")) {
+                    $candidates += $candidate.TrimEnd("\\")
+                }
+            }
+
+            if ($candidates.Count -eq 0) {
+                throw "Disk number '$diskNumber' does not contain a Windows OS volume (missing Windows\\System32\\config\\SYSTEM)."
+            }
+
+            if ($candidates.Count -gt 1) {
+                Write-Warning "Multiple Windows roots found on disk ${diskNumber}: $($candidates -join ', '). Using: $($candidates[0])"
+            }
+
+            return $candidates[0]
+        }
+
+        if ($normalizedDisk -match "^[A-Z]$") {
+            $normalizedDisk = "${normalizedDisk}:"
+        }
+        elseif ($normalizedDisk -match "^[A-Z]:\\$") {
+            $normalizedDisk = $normalizedDisk.Substring(0, 2)
+        }
+
+        if ($normalizedDisk -notmatch "^[A-Z]:$") {
+            throw "-Disk must be a disk number (for example '2') or drive letter like 'E', 'E:' or 'E:\\'. Provided: $DiskSpecifier"
+        }
+
+        $driveLetter = $normalizedDisk.Substring(0, 1)
+        $partition = Get-Partition -DriveLetter $driveLetter -ErrorAction SilentlyContinue | Select-Object -First 1
+        if (-not $partition) {
+            throw "Drive '$normalizedDisk' was not found."
+        }
+        Ensure-DiskReady -DiskNumber $partition.DiskNumber
+
+        $diskRoot = "$normalizedDisk\\"
+        $candidate = Join-Path $diskRoot "Windows"
+
+        if (-not (Test-Path -LiteralPath $candidate)) {
+            throw "The specified disk does not contain a Windows folder: $candidate"
+        }
+
+        if (-not (Test-Path -LiteralPath (Join-Path $candidate "System32\config\SYSTEM"))) {
+            throw "Disk '$normalizedDisk' does not appear to be a Windows OS disk (missing System32\\config\\SYSTEM under $candidate)."
+        }
+
+        return $candidate.TrimEnd("\\")
+    }
+
     if (-not [string]::IsNullOrWhiteSpace($RequestedPath)) {
         $normalized = $RequestedPath.TrimEnd("\\")
         if (-not (Test-Path -LiteralPath $normalized)) {
@@ -119,35 +234,63 @@ function Run-OptionalTss {
         throw "TSS script not found: $Path"
     }
 
-    $invokeArgs = New-Object System.Collections.Generic.List[string]
+    $tokens = @()
     if ($Arguments) {
         foreach ($arg in $Arguments) {
             if (-not [string]::IsNullOrWhiteSpace($arg)) {
-                $invokeArgs.Add($arg) | Out-Null
+                $tokens += $arg.Trim()
             }
         }
     }
 
-    if ($AutoAcceptEula -and -not ($invokeArgs -contains "-AcceptEula")) {
-        $invokeArgs.Add("-AcceptEula") | Out-Null
+    if ($AutoAcceptEula -and -not ($tokens -contains "-AcceptEula")) {
+        $tokens += "-AcceptEula"
     }
 
-$invokeArgsArray = $invokeArgs.ToArray()
-Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($invokeArgsArray -join " ")) -ForegroundColor Yellow
-& $Path @invokeArgsArray
-Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
+    # Parse the flat token list into a parameter hashtable so TSS is invoked by
+    # named parameters. Array splatting (& $Path @array) does NOT reliably
+    # resolve TSS's parameter sets and raises AmbiguousParameterSet; hashtable
+    # splatting binds parameters by name exactly like an interactive command
+    # line and resolves the parameter set correctly.
+    $tssParams = [ordered]@{}
+    $i = 0
+    while ($i -lt $tokens.Count) {
+        $tok = $tokens[$i]
+        if ($tok -like "-*") {
+            $name = $tok.TrimStart("-")
+            if (($i + 1) -lt $tokens.Count -and ($tokens[$i + 1] -notlike "-*")) {
+                $tssParams[$name] = $tokens[$i + 1]
+                $i += 2
+            }
+            else {
+                $tssParams[$name] = $true
+                $i += 1
+            }
+        }
+        else {
+            $i += 1
+        }
+    }
+
+    Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($tokens -join " ")) -ForegroundColor Yellow
+    & $Path @tssParams
+    Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
 }
 
-$resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot
+$resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot -DiskSpecifier $Disk
 $offlineRoot = Split-Path -Parent $resolvedWindowsRoot
 $offlineRoot = if ([string]::IsNullOrWhiteSpace($offlineRoot)) { Split-Path -Qualifier $resolvedWindowsRoot } else { $offlineRoot }
-$timeStamp = Get-Date -Format "yyyyMMdd-HHmmss"
+$timeStamp = Get-Date -Format "yyyyMMdd-HHmmss-fff"
+
+if (-not (Test-Path -LiteralPath $msDataRoot)) {
+    New-Item -Path $msDataRoot -ItemType Directory -Force | Out-Null
+}
 
-if (-not (Test-Path -LiteralPath $OutputRoot)) {
-    New-Item -Path $OutputRoot -ItemType Directory -Force | Out-Null
+if (-not (Test-Path -LiteralPath $outputRoot)) {
+    New-Item -Path $outputRoot -ItemType Directory -Force | Out-Null
 }
 
-$outputFolder = Join-Path $OutputRoot "offline-tss-wrapper-$timeStamp"
+$outputFolder = Join-Path $outputRoot "offline-tss-wrapper-$timeStamp"
 
 if ((Test-Path -LiteralPath $outputFolder) -and -not $Force) {
     throw "Output folder already exists: $outputFolder. Use -Force to overwrite."
@@ -157,6 +300,8 @@ New-Item -Path $outputFolder -ItemType Directory -Force | Out-Null
 
 Write-Host "Offline Windows root : $resolvedWindowsRoot" -ForegroundColor Green
 Write-Host "Offline disk root    : $offlineRoot" -ForegroundColor Green
+Write-Host "MS_DATA root         : $msDataRoot" -ForegroundColor Green
+Write-Host "Output root          : $outputRoot" -ForegroundColor Green
 Write-Host "Output folder        : $outputFolder" -ForegroundColor Green
 
 # Collect a practical offline bundle aligned with Windows Update / DnD troubleshooting.
@@ -190,27 +335,36 @@ if ($IncludeRegistryHives) {
     }
 }
 
-if ($RunTssOnRescueVm) {
-    if ([string]::IsNullOrWhiteSpace($TssPath)) {
-        $candidate = Join-Path $PSScriptRoot "..\TSS\TSS.ps1"
-        if (Test-Path -LiteralPath $candidate) {
-            $TssPath = (Resolve-Path $candidate).Path
-        }
-        else {
-            throw "-RunTssOnRescueVm was set, but -TssPath was not provided and default candidate was not found: $candidate"
-        }
-    }
+if ([string]::IsNullOrWhiteSpace($TssPath)) {
+    $candidate = Join-Path $PSScriptRoot "TSS\TSS.ps1"
+    Write-Host "[tss] -TssPath not provided. Checking default path: $candidate" -ForegroundColor Yellow
 
-    $effectiveTssArgs = @()
-    if ($TssArguments -and $TssArguments.Count -gt 0) {
-        $effectiveTssArgs = $TssArguments
+    if (Test-Path -LiteralPath $candidate) {
+        $TssPath = (Resolve-Path $candidate).Path
+        Write-Host "[tss] Found default TSS script: $TssPath" -ForegroundColor Green
     }
     else {
-        $effectiveTssArgs = @("-CollectLog", $TssCollectLog)
+        Write-Host "[tss] Default TSS script was not found: $candidate" -ForegroundColor Red
+        Write-Host "[tss] Expected layout:" -ForegroundColor Yellow
+        Write-Host "       $PSScriptRoot" -ForegroundColor Yellow
+        Write-Host "       $PSScriptRoot\TSS\TSS.ps1" -ForegroundColor Yellow
+        Write-Host "[tss] Action: unzip the TSS folder in the same directory as this wrapper, or provide -TssPath explicitly." -ForegroundColor Yellow
+        throw "-TssPath was not provided and wrapper-local default was not found: $candidate"
     }
+}
 
-    Run-OptionalTss -Path $TssPath -Arguments $effectiveTssArgs -AutoAcceptEula:(-not $NoAcceptEula)
+$effectiveTssArgs = @()
+if ($TssArguments -and $TssArguments.Count -gt 0) {
+    $effectiveTssArgs = $TssArguments
+}
+elseif (-not [string]::IsNullOrWhiteSpace($TssCollectLog)) {
+    $effectiveTssArgs = @("-CollectLog", $TssCollectLog)
 }
+else {
+    $effectiveTssArgs = @("-SDP", "Setup")
+}
+
+Run-OptionalTss -Path $TssPath -Arguments $effectiveTssArgs -AutoAcceptEula:(-not $NoAcceptEula)
 
 if ($ZipOutput) {
     $zipPath = "$outputFolder.zip"
@@ -223,4 +377,5 @@ if ($ZipOutput) {
 }
 
 Write-Host "Offline rescue collection complete." -ForegroundColor Green
+Write-Host "Data location: $outputRoot" -ForegroundColor Green
 Write-Host "Bundle path: $outputFolder" -ForegroundColor Green
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 9cb58c0..4041dc1 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -1,43 +1,91 @@
 # TSS Offline Rescue Wrapper
 
 ## Overview
-This script helps when the target VM cannot boot and its OS disk is attached to a rescue VM:
+This script is for rescue-VM scenarios where the broken VM OS disk is attached offline:
 - Copies offline Windows troubleshooting artifacts from the attached disk.
-- Optionally runs TSS on the rescue VM.
-- Accepts any TSS switch set using `-TssArguments`.
-- No telemetry/metadata output files are generated by this wrapper.
+- Always runs TSS on the rescue VM context.
+- Uses default TSS mode `-SDP Setup` when no explicit TSS arguments are provided.
+- Supports explicit `-TssCollectLog` or full pass-through `-TssArguments`.
+- Uses fixed output root `C:\MS_DATA\TSS_PERF_OFFLINE`.
 
-## Files
+## File
 - `Invoke-TSSOfflineRescueWrapper.ps1`
 
+## TSS Folder Expectation (Default)
+If `-TssPath` is not provided, the script expects:
+
+```text
+<wrapper-folder>\TSS\TSS.ps1
+```
+
+Example:
+
+```text
+RunCommand\Windows\TSSOfflineRescueWrapper\Invoke-TSSOfflineRescueWrapper.ps1
+RunCommand\Windows\TSSOfflineRescueWrapper\TSS\TSS.ps1
+```
+
+If not present, the script prints screen guidance and stops.
+
+Disk selection note: `-Disk 2` in examples is sample syntax. Replace `2` with the disk number that contains the offline OS.
+
 ## Examples
 
-### Offline collection only
+### Default run (uses `-SDP Setup`)
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -ZipOutput
+```
+
+### DND setup report
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssCollectLog DND_SetupReport -ZipOutput
 ```
 
-### Offline collection + default TSS mode (`-CollectLog DND_SetupReport`)
+### TSS UEX example
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -RunTssOnRescueVm -TssPath C:\TSS\TSS.ps1
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-UEX_RDSsrv') -ZipOutput
 ```
 
-### Offline collection + custom TSS switches
+### Directory Services (DS) example
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -OfflineWindowsRoot F:\Windows -RunTssOnRescueVm -TssPath C:\TSS\TSS.ps1 -TssArguments @('-SDP','Setup','-SkipSDPList','skipBPA,skipTS')
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Dom') -ZipOutput
 ```
 
-## Key Parameters
+### Use disk number auto-detection
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssCollectLog DND_SetupReport -ZipOutput
+```
+
+### Use wrapper-local default TSS path
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -ZipOutput
+```
+
+### Custom TSS switches
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Setup') -ZipOutput
+```
+
+## Parameters
 - `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
-- `-OutputRoot <path>`: Root for output bundles. Default `C:\MS_DATA\OfflineTSSWrapper`.
-- `-IncludeRegistryHives`: Include SYSTEM/SOFTWARE/SAM/SECURITY/DEFAULT/COMPONENTS hives.
-- `-RunTssOnRescueVm`: Runs TSS in rescue VM context.
-- `-TssPath <path>`: Path to TSS script.
+- `-Disk <number|drive>`: Disk selector, supports disk number (`2`) or drive (`E`, `E:`, `E:\`).
+- `-TssPath <path>`: Optional explicit path to `TSS.ps1`. If omitted, wrapper-local default is used.
+- `-TssCollectLog <name>`: Optional override to run `-CollectLog <name>`.
 - `-TssArguments <string[]>`: Any TSS args passed as-is.
-- `-TssCollectLog <name>`: Fallback used only if `-TssArguments` is omitted.
+- `-IncludeRegistryHives`: Include SYSTEM/SOFTWARE/SAM/SECURITY/DEFAULT/COMPONENTS hives.
 - `-NoAcceptEula`: Prevent automatic `-AcceptEula` append.
 - `-ZipOutput`: Create zip after collection.
+- `-Force`: Allow overwrite when output folder already exists.
+
+## Output
+- Root: `C:\MS_DATA\TSS_PERF_OFFLINE`
+- Run folder: `offline-tss-wrapper-<timestamp>`
+- Optional zip: `offline-tss-wrapper-<timestamp>.zip`
 
 ## Notes
-- This does not run TSS against an offline image directly; it collects offline artifacts and can run TSS on the rescue VM itself.
+- The script no longer uses `-RunTssOnRescueVm`.
+- The script no longer uses `-OutputRoot`.
+- If neither `-TssArguments` nor `-TssCollectLog` is provided, wrapper defaults to `-SDP Setup`.
+- Note: `-SDP Perf` is deprecated in current TSS; use `-SDP Setup`.
+- DS (Directory Services) SDP key is `Dom` in TSS (`-SDP Dom`).
 - Use elevated PowerShell on the rescue VM.

From 315106c734748d980ce8c397ece64d425795172d Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 11:34:25 -0500
Subject: [PATCH 09/17] Reformat README to repo house style; rename to TSS
 Offline Log Collector

---
 .../Windows/TSSOfflineRescueWrapper/readme.md | 82 +++++++++++--------
 1 file changed, 50 insertions(+), 32 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 4041dc1..cb5f28e 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -1,17 +1,30 @@
-# TSS Offline Rescue Wrapper
+# TSS Offline Log Collector
 
-## Overview
-This script is for rescue-VM scenarios where the broken VM OS disk is attached offline:
-- Copies offline Windows troubleshooting artifacts from the attached disk.
-- Always runs TSS on the rescue VM context.
-- Uses default TSS mode `-SDP Setup` when no explicit TSS arguments are provided.
-- Supports explicit `-TssCollectLog` or full pass-through `-TssArguments`.
-- Uses fixed output root `C:\MS_DATA\TSS_PERF_OFFLINE`.
+This PowerShell script is for rescue-VM scenarios where the broken VM OS disk is attached offline to a working rescue VM. It collects offline Windows troubleshooting logs from the attached disk and then runs TSS in the rescue VM context.
 
-## File
-- `Invoke-TSSOfflineRescueWrapper.ps1`
+## What It Does
+
+1. **Offline Log Collection**
+   - Copies offline Windows troubleshooting logs from the attached disk (event logs, CBS, DISM, Panther, setupapi, Software Distribution, catroot2, USO logs, and optional registry hives).
+
+2. **TSS Execution**
+   - Always runs TSS on the rescue VM context.
+   - Uses default TSS mode `-SDP Setup` when no explicit TSS arguments are provided.
+   - Supports explicit `-TssCollectLog` or full pass-through `-TssArguments`.
+
+3. **Output Packaging**
+   - Writes to fixed output root `C:\MS_DATA\TSS_PERF_OFFLINE`.
+   - Optionally creates a zip of the run folder.
+
+## Prerequisites
+
+- PowerShell 5.1 or higher.
+- **Run from an elevated (Run as administrator) PowerShell console.**
+- **Must run in the standard PowerShell console host (`ConsoleHost`), not PowerShell ISE.**
+- The broken VM OS disk must already be attached to the rescue VM.
 
 ## TSS Folder Expectation (Default)
+
 If `-TssPath` is not provided, the script expects:
 
 ```text
@@ -29,44 +42,38 @@ If not present, the script prints screen guidance and stops.
 
 Disk selection note: `-Disk 2` in examples is sample syntax. Replace `2` with the disk number that contains the offline OS.
 
-## Examples
+## Usage
 
-### Default run (uses `-SDP Setup`)
-```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -ZipOutput
-```
+From an elevated PowerShell console, in the directory that contains the script:
 
-### DND setup report
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssCollectLog DND_SetupReport -ZipOutput
+Set-ExecutionPolicy Bypass -Force
 ```
 
-### TSS UEX example
-```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-UEX_RDSsrv') -ZipOutput
-```
+## Quick Start
 
-### Directory Services (DS) example
+### Default is Setup/Perf Report
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Dom') -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -ZipOutput
 ```
 
-### Use disk number auto-detection
+### DND setup report
 ```powershell
 .\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssCollectLog DND_SetupReport -ZipOutput
 ```
 
-### Use wrapper-local default TSS path
+### UEX Report
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-UEX_RDSsrv') -ZipOutput
 ```
 
-### Custom TSS switches
+### Directory Services (DS) report
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Setup') -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Dom') -ZipOutput
 ```
 
 ## Parameters
+
 - `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
 - `-Disk <number|drive>`: Disk selector, supports disk number (`2`) or drive (`E`, `E:`, `E:\`).
 - `-TssPath <path>`: Optional explicit path to `TSS.ps1`. If omitted, wrapper-local default is used.
@@ -78,14 +85,25 @@ Disk selection note: `-Disk 2` in examples is sample syntax. Replace `2` with th
 - `-Force`: Allow overwrite when output folder already exists.
 
 ## Output
+
 - Root: `C:\MS_DATA\TSS_PERF_OFFLINE`
 - Run folder: `offline-tss-wrapper-<timestamp>`
 - Optional zip: `offline-tss-wrapper-<timestamp>.zip`
 
 ## Notes
-- The script no longer uses `-RunTssOnRescueVm`.
-- The script no longer uses `-OutputRoot`.
+
 - If neither `-TssArguments` nor `-TssCollectLog` is provided, wrapper defaults to `-SDP Setup`.
-- Note: `-SDP Perf` is deprecated in current TSS; use `-SDP Setup`.
+- `-SDP Perf` is deprecated in current TSS; use `-SDP Setup`.
 - DS (Directory Services) SDP key is `Dom` in TSS (`-SDP Dom`).
-- Use elevated PowerShell on the rescue VM.
+
+## Known Issues
+
+- TSS SDP collection must run in the standard PowerShell console host. Running directly inside PowerShell ISE fails because the SDP module depends on console-host-only properties. Use a standard elevated PowerShell console, or invoke with `powershell -ExecutionPolicy Bypass -File <script>` which launches a fresh console host.
+
+## Liability
+
+As described in the [MIT license](..\..\..\LICENSE.txt), these scripts are provided as-is with no warranty or liability associated with their use.
+
+## Provide Feedback
+
+We value your input. If you encounter problems with the scripts or have ideas on how they can be improved, please file an issue in the [Issues](https://github.com/Azure/azure-support-scripts/issues) section of the project.

From 34c4593fa5fea6e494f74e312653131dce8e363c Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 12:41:26 -0500
Subject: [PATCH 10/17] Remove Windows_OSUpgrade_Assessment_Validation.ps1
 changes (moved to PR #133)

---
 ...indows_OSUpgrade_Assessment_Validation.ps1 | 52 -------------------
 1 file changed, 52 deletions(-)

diff --git a/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1 b/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
index 570c5a7..00618c3 100644
--- a/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
+++ b/RunCommand/Windows/Windows_OSUpgrade_Assessment_Validation/Windows_OSUpgrade_Assessment_Validation.ps1
@@ -33,30 +33,6 @@ Disclaimer:
     PS> .\Windows_OSUpgrade_Assessment_Validation.ps1
 #>
 
-# ---- Legacy driver and GlobalFlag detection ----------------------------------
-function Get-LegacyDriverBlockers {
-    # Known legacy VMware / ghost hardware drivers that cause 0xC1900101-0x50016
-    $knownBlockers = @('vmmouse', 'vm3dmp', 'flpydisk', 'vmhgfs', 'vmrawdsk', 'vmusbmouse', 'vmvss', 'vmscsi', 'vmxnet')
-    $found = @()
-    foreach ($name in $knownBlockers) {
-        $svcPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$name"
-        if (Test-Path $svcPath) {
-            $start = (Get-ItemProperty $svcPath -ErrorAction SilentlyContinue).Start
-            # Start values: 0=Boot, 1=System, 2=Auto, 3=Manual, 4=Disabled
-            if ($null -ne $start -and $start -le 3) {
-                $found += $name
-            }
-        }
-    }
-    return $found
-}
-
-function Get-GlobalFlagStatus {
-    $smPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager"
-    $gf = (Get-ItemProperty $smPath -Name GlobalFlag -ErrorAction SilentlyContinue).GlobalFlag
-    return ($null -ne $gf -and $gf -ne 0)
-}
-
 # ---- Safety checks -----------------------------------------------------------
 function Assert-Admin {
     $isAdmin = ([Security.Principal.WindowsPrincipal] `
@@ -226,10 +202,6 @@ if ($isServer) {
     }
 }
 
-# --- Run legacy driver and GlobalFlag checks (server IPU blocker detection) ---
-$legacyDriverBlockers = Get-LegacyDriverBlockers
-$globalFlagEnabled    = Get-GlobalFlagStatus
-
 # --- Checklist Output ---
 $checklist = @()
 $checklist += "Windows Version: $windowsProductName"
@@ -284,30 +256,6 @@ if ($isServer) {
     }
 }
 
-# Legacy Driver / Ghost Hardware Check (IPU blocker)
-if ($legacyDriverBlockers.Count -gt 0) {
-    $checklist += "[Failed] Legacy IPU-blocking drivers detected: $($legacyDriverBlockers -join ', ')"
-    $messages += ""
-    $messages += "FAILED: Legacy VMware/ghost hardware drivers are present and set to load. These will cause IPU to fail with error 0xC1900101-0x50016 (SafeOS boot crash)."
-    $messages += "  Drivers found: $($legacyDriverBlockers -join ', ')"
-    $messages += "  Action: In Device Manager, DISABLE (do not uninstall) each legacy device before retrying IPU."
-    $messages += "  Note: Uninstalling may allow PnP to reinstall the driver on next reboot. Disable ensures it stays dormant during upgrade."
-} else {
-    $checklist += "[Passed] No legacy IPU-blocking drivers detected"
-}
-
-# GlobalFlag (PageHeap/debug mode) Check
-if ($globalFlagEnabled) {
-    $checklist += "[Failed] GlobalFlag debug mode is enabled (causes throttled Setup and slow IPU rollback)"
-    $messages += ""
-    $messages += "FAILED: GlobalFlag is enabled in Session Manager. This forces Windows Setup to run in debug/PageHeap mode, causing severely throttled memory operations during IPU and a guaranteed rollback."
-    $messages += "  Action: Disable GlobalFlag before retrying IPU:"
-    $messages += '  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v GlobalFlag /f'
-    $messages += "  Then reboot the VM before attempting the in-place upgrade."
-} else {
-    $checklist += "[Passed] GlobalFlag debug mode is not enabled"
-}
-
 # Output checklist first, then messages
 $checklist | ForEach-Object { Write-Output $_ }
 $messages | ForEach-Object { Write-Output $_ }

From f9ef19ac2369a6edd0f411956ee26715d32c3a0d Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 13:11:17 -0500
Subject: [PATCH 11/17] [P1 FIX] Security: Gate credential-bearing registry
 hives behind explicit consent

- Split registry hive collection into safe (SYSTEM/SOFTWARE/COMPONENTS) and credential-bearing (SAM/SECURITY/DEFAULT)
- -IncludeRegistryHives now collects only safe diagnostic hives by default
- New -IncludeCredentialHives switch required to collect SAM/SECURITY/DEFAULT
- Added explicit warning when credential hives are collected
- Updated readme with security documentation and usage examples

Resolves PR #131 P1 blocker: prevents local account hashes, LSA secrets, and DPAPI material from being collected by default in support bundles.
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 24 +++++++++++++++++--
 .../Windows/TSSOfflineRescueWrapper/readme.md | 14 ++++++++++-
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index 32b68ad..4d94fe2 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -18,6 +18,9 @@ param(
     [Parameter(Mandatory = $false)]
     [switch]$IncludeRegistryHives,
 
+    [Parameter(Mandatory = $false)]
+    [switch]$IncludeCredentialHives,
+
     [Parameter(Mandatory = $false)]
     [switch]$ZipOutput,
 
@@ -327,12 +330,29 @@ foreach ($item in $pathsToCollect) {
 
 if ($IncludeRegistryHives) {
     $hiveFolder = Join-Path $resolvedWindowsRoot "System32\config"
-    $hives = @("SYSTEM", "SOFTWARE", "SAM", "SECURITY", "DEFAULT", "COMPONENTS")
-    foreach ($hive in $hives) {
+    
+    # Core diagnostic hives (safe for support bundles)
+    $safeHives = @("SYSTEM", "SOFTWARE", "COMPONENTS")
+    
+    foreach ($hive in $safeHives) {
         $sourceHive = Join-Path $hiveFolder $hive
         $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
         Copy-IfPresent -Source $sourceHive -Destination $destHive
     }
+    
+    # Credential-bearing hives (requires explicit consent)
+    if ($IncludeCredentialHives) {
+        Write-Warning "⚠️  CREDENTIAL HIVES: Collecting SAM, SECURITY, and DEFAULT registry hives."
+        Write-Warning "    These hives contain sensitive credential material (password hashes, LSA secrets, DPAPI data)."
+        Write-Warning "    Only collect these if explicitly required for your troubleshooting scenario."
+        
+        $credentialHives = @("SAM", "SECURITY", "DEFAULT")
+        foreach ($hive in $credentialHives) {
+            $sourceHive = Join-Path $hiveFolder $hive
+            $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
+            Copy-IfPresent -Source $sourceHive -Destination $destHive
+        }
+    }
 }
 
 if ([string]::IsNullOrWhiteSpace($TssPath)) {
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index cb5f28e..870f441 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -72,6 +72,17 @@ Set-ExecutionPolicy Bypass -Force
 .\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Dom') -ZipOutput
 ```
 
+### With registry hives (safe diagnostic hives only)
+```powershell
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -IncludeRegistryHives -ZipOutput
+```
+
+### ⚠️ With credential-bearing registry hives (use with caution)
+```powershell
+# Only use when explicitly required for troubleshooting
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -IncludeRegistryHives -IncludeCredentialHives -ZipOutput
+```
+
 ## Parameters
 
 - `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
@@ -79,7 +90,8 @@ Set-ExecutionPolicy Bypass -Force
 - `-TssPath <path>`: Optional explicit path to `TSS.ps1`. If omitted, wrapper-local default is used.
 - `-TssCollectLog <name>`: Optional override to run `-CollectLog <name>`.
 - `-TssArguments <string[]>`: Any TSS args passed as-is.
-- `-IncludeRegistryHives`: Include SYSTEM/SOFTWARE/SAM/SECURITY/DEFAULT/COMPONENTS hives.
+- `-IncludeRegistryHives`: Include safe diagnostic registry hives (SYSTEM, SOFTWARE, COMPONENTS).
+- `-IncludeCredentialHives`: **⚠️ SECURITY SENSITIVE** — Include credential-bearing hives (SAM, SECURITY, DEFAULT). Requires `-IncludeRegistryHives`. These hives contain password hashes, LSA secrets, and DPAPI material. Only use when explicitly required for troubleshooting.
 - `-NoAcceptEula`: Prevent automatic `-AcceptEula` append.
 - `-ZipOutput`: Create zip after collection.
 - `-Force`: Allow overwrite when output folder already exists.

From d9e65cd39aa828c56fd05e89aa1e82a1b34f3dd6 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 13:32:40 -0500
Subject: [PATCH 12/17] [MAJOR] Refactor to Option A: pure offline static
 collection

BREAKING CHANGE: Removed TSS.ps1 execution entirely. This wrapper now performs ONLY offline static file collection from the broken disk. TSS.ps1 cannot run against offline disks, so the previous hybrid design was fundamentally flawed.

**New features:**
- -OutputPath parameter to override default C:\MS_DATA\TSS_PERF_OFFLINE
- -IncludeMemoryDump opt-in switch for MEMORY.DMP (large + may contain secrets)
- Write-Progress with per-artifact size for long copies (CBS, catroot2, dumps)
- Chain-of-custody manifest (manifest.json) with SHA-256 hashes
- Self-transcript (wrapper-transcript.log) saved to bundle
- -WhatIf support for dry-run preview
- Collection summary (items copied/skipped, total size)

**Removed:**
- All TSS.ps1 execution code
- Parameters: -TssPath, -TssCollectLog, -TssArguments, -NoAcceptEula

**Security enhancements (from P1 fix):**
- MEMORY.DMP moved to opt-in (-IncludeMemoryDump) with size warning
- Registry hives split: safe (SYSTEM/SOFTWARE/COMPONENTS) vs credential-bearing (SAM/SECURITY/DEFAULT)
- Credential hives require explicit -IncludeCredentialHives + warning

**Documentation:**
- Readme completely rewritten to reflect Option A design
- Clear explanation: static offline collection only, no live diagnostics
- Updated examples and parameter documentation
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 295 +++++++++++-------
 .../Windows/TSSOfflineRescueWrapper/readme.md | 109 +++----
 2 files changed, 235 insertions(+), 169 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index 4d94fe2..1fef8c3 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -1,4 +1,4 @@
-[CmdletBinding()]
+[CmdletBinding(SupportsShouldProcess)]
 param(
     [Parameter(Mandatory = $false)]
     [string]$OfflineWindowsRoot,
@@ -7,13 +7,7 @@ param(
     [string]$Disk,
 
     [Parameter(Mandatory = $false)]
-    [string]$TssPath,
-
-    [Parameter(Mandatory = $false)]
-    [string]$TssCollectLog,
-
-    [Parameter(Mandatory = $false)]
-    [string[]]$TssArguments,
+    [string]$OutputPath,
 
     [Parameter(Mandatory = $false)]
     [switch]$IncludeRegistryHives,
@@ -22,10 +16,10 @@ param(
     [switch]$IncludeCredentialHives,
 
     [Parameter(Mandatory = $false)]
-    [switch]$ZipOutput,
+    [switch]$IncludeMemoryDump,
 
     [Parameter(Mandatory = $false)]
-    [switch]$NoAcceptEula,
+    [switch]$ZipOutput,
 
     [Parameter(Mandatory = $false)]
     [switch]$Force
@@ -33,8 +27,13 @@ param(
 
 $ErrorActionPreference = "Stop"
 
-$msDataRoot = "C:\MS_DATA"
-$outputRoot = Join-Path $msDataRoot "TSS_PERF_OFFLINE"
+if ([string]::IsNullOrWhiteSpace($OutputPath)) {
+    $msDataRoot = "C:\MS_DATA"
+    $outputRoot = Join-Path $msDataRoot "TSS_PERF_OFFLINE"
+}
+else {
+    $outputRoot = $OutputPath
+}
 
 function Ensure-DiskReady {
     param(
@@ -204,82 +203,131 @@ function Copy-IfPresent {
         [string]$Source,
 
         [Parameter(Mandatory = $true)]
-        [string]$Destination
+        [string]$Destination,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Activity = "Collecting offline files",
+
+        [Parameter(Mandatory = $false)]
+        [int]$ProgressId = 1
     )
 
     if (-not (Test-Path -LiteralPath $Source)) {
         Write-Host "[skip] Missing: $Source" -ForegroundColor DarkYellow
+        $script:manifestEntries += @{
+            Source = $Source
+            Destination = $Destination
+            Status = "Missing"
+            SizeBytes = 0
+            SHA256 = "N/A"
+        }
         return
     }
 
+    # Calculate size for progress reporting
+    $sourceItem = Get-Item -LiteralPath $Source -ErrorAction SilentlyContinue
+    $sizeBytes = 0
+    $sizeMB = 0
+
+    if ($sourceItem) {
+        if ($sourceItem.PSIsContainer) {
+            $sizeBytes = (Get-ChildItem -LiteralPath $Source -Recurse -File -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum).Sum
+        }
+        else {
+            $sizeBytes = $sourceItem.Length
+        }
+        $sizeMB = [math]::Round($sizeBytes / 1MB, 2)
+    }
+
     $destParent = Split-Path -Parent $Destination
     if (-not (Test-Path -LiteralPath $destParent)) {
         New-Item -Path $destParent -ItemType Directory -Force | Out-Null
     }
 
-    try {
-        Copy-Item -LiteralPath $Source -Destination $Destination -Recurse -Force -ErrorAction Stop
-        Write-Host "[copy] $Source -> $Destination" -ForegroundColor DarkCyan
+    $sourceName = Split-Path -Leaf $Source
+    $status = if ($sizeMB -gt 0) { "Copying $sourceName ($sizeMB MB)" } else { "Copying $sourceName" }
+
+    Write-Progress -Id $ProgressId -Activity $Activity -Status $status -PercentComplete -1
+
+    if ($PSCmdlet.ShouldProcess($Source, "Copy to $Destination")) {
+        try {
+            Copy-Item -LiteralPath $Source -Destination $Destination -Recurse -Force -ErrorAction Stop -WhatIf:$WhatIfPreference
+            Write-Host "[copy] $Source -> $Destination ($sizeMB MB)" -ForegroundColor DarkCyan
+
+            $hash = Get-FileHashSafe -Path $Destination
+            $script:manifestEntries += @{
+                Source = $Source
+                Destination = $Destination
+                Status = "Copied"
+                SizeBytes = $sizeBytes
+                SHA256 = $hash
+            }
+        }
+        catch {
+            Write-Warning "[skip] Failed to copy $Source. Reason: $($_.Exception.Message)"
+            $script:manifestEntries += @{
+                Source = $Source
+                Destination = $Destination
+                Status = "Failed: $($_.Exception.Message)"
+                SizeBytes = $sizeBytes
+                SHA256 = "N/A"
+            }
+        }
+        finally {
+            Write-Progress -Id $ProgressId -Activity $Activity -Completed
+        }
     }
-    catch {
-        Write-Warning "[skip] Failed to copy $Source. Reason: $($_.Exception.Message)"
+    else {
+        Write-Host "[whatif] Would copy: $Source -> $Destination ($sizeMB MB)" -ForegroundColor Yellow
+        $script:manifestEntries += @{
+            Source = $Source
+            Destination = $Destination
+            Status = "WhatIf"
+            SizeBytes = $sizeBytes
+            SHA256 = "N/A"
+        }
+        Write-Progress -Id $ProgressId -Activity $Activity -Completed
     }
 }
 
-function Run-OptionalTss {
+function Test-FreeSpace {
     param(
         [string]$Path,
-        [string[]]$Arguments,
-        [switch]$AutoAcceptEula
+        [long]$RequiredBytes
     )
 
-    if (-not (Test-Path -LiteralPath $Path)) {
-        throw "TSS script not found: $Path"
+    $volume = Get-Volume -FilePath $Path -ErrorAction SilentlyContinue
+    if (-not $volume) {
+        Write-Warning "Could not determine free space for $Path"
+        return $true  # Proceed anyway if we can't check
     }
 
-    $tokens = @()
-    if ($Arguments) {
-        foreach ($arg in $Arguments) {
-            if (-not [string]::IsNullOrWhiteSpace($arg)) {
-                $tokens += $arg.Trim()
-            }
-        }
+    $freeBytes = $volume.SizeRemaining
+    if ($freeBytes -lt $RequiredBytes) {
+        $requiredGB = [math]::Round($RequiredBytes / 1GB, 2)
+        $freeGB = [math]::Round($freeBytes / 1GB, 2)
+        throw "Insufficient disk space. Required: ${requiredGB} GB, Available: ${freeGB} GB on $($volume.DriveLetter):"
     }
 
-    if ($AutoAcceptEula -and -not ($tokens -contains "-AcceptEula")) {
-        $tokens += "-AcceptEula"
-    }
+    return $true
+}
 
-    # Parse the flat token list into a parameter hashtable so TSS is invoked by
-    # named parameters. Array splatting (& $Path @array) does NOT reliably
-    # resolve TSS's parameter sets and raises AmbiguousParameterSet; hashtable
-    # splatting binds parameters by name exactly like an interactive command
-    # line and resolves the parameter set correctly.
-    $tssParams = [ordered]@{}
-    $i = 0
-    while ($i -lt $tokens.Count) {
-        $tok = $tokens[$i]
-        if ($tok -like "-*") {
-            $name = $tok.TrimStart("-")
-            if (($i + 1) -lt $tokens.Count -and ($tokens[$i + 1] -notlike "-*")) {
-                $tssParams[$name] = $tokens[$i + 1]
-                $i += 2
-            }
-            else {
-                $tssParams[$name] = $true
-                $i += 1
-            }
-        }
-        else {
-            $i += 1
-        }
-    }
+function Get-FileHashSafe {
+    param(
+        [string]$Path
+    )
 
-    Write-Host ("[tss] Starting TSS: {0} {1}" -f $Path, ($tokens -join " ")) -ForegroundColor Yellow
-    & $Path @tssParams
-    Write-Host "[tss] Completed TSS collection." -ForegroundColor Green
+    try {
+        $hash = Get-FileHash -LiteralPath $Path -Algorithm SHA256 -ErrorAction Stop
+        return $hash.Hash
+    }
+    catch {
+        return "ERROR: $($_.Exception.Message)"
+    }
 }
 
+$script:manifestEntries = @()
+
 $resolvedWindowsRoot = Resolve-OfflineWindowsRoot -RequestedPath $OfflineWindowsRoot -DiskSpecifier $Disk
 $offlineRoot = Split-Path -Parent $resolvedWindowsRoot
 $offlineRoot = if ([string]::IsNullOrWhiteSpace($offlineRoot)) { Split-Path -Qualifier $resolvedWindowsRoot } else { $offlineRoot }
@@ -301,90 +349,111 @@ if ((Test-Path -LiteralPath $outputFolder) -and -not $Force) {
 
 New-Item -Path $outputFolder -ItemType Directory -Force | Out-Null
 
+# Start transcript for this run
+$transcriptPath = Join-Path $outputFolder "wrapper-transcript.log"
+Start-Transcript -LiteralPath $transcriptPath -Force | Out-Null
+
 Write-Host "Offline Windows root : $resolvedWindowsRoot" -ForegroundColor Green
 Write-Host "Offline disk root    : $offlineRoot" -ForegroundColor Green
-Write-Host "MS_DATA root         : $msDataRoot" -ForegroundColor Green
 Write-Host "Output root          : $outputRoot" -ForegroundColor Green
 Write-Host "Output folder        : $outputFolder" -ForegroundColor Green
+Write-Host "Transcript           : $transcriptPath" -ForegroundColor Green
 
 # Collect a practical offline bundle aligned with Windows Update / DnD troubleshooting.
 $pathsToCollect = @(
-    @{ Rel = "Windows\System32\winevt\Logs"; Dest = "offline\winevt\Logs" },
-    @{ Rel = "Windows\Logs\CBS"; Dest = "offline\Windows\Logs\CBS" },
-    @{ Rel = "Windows\Logs\DISM"; Dest = "offline\Windows\Logs\DISM" },
-    @{ Rel = "Windows\Panther"; Dest = "offline\Windows\Panther" },
-    @{ Rel = "Windows\INF\setupapi.dev.log"; Dest = "offline\Windows\INF\setupapi.dev.log" },
-    @{ Rel = "Windows\INF\setupapi.setup.log"; Dest = "offline\Windows\INF\setupapi.setup.log" },
-    @{ Rel = "Windows\SoftwareDistribution\ReportingEvents.log"; Dest = "offline\Windows\SoftwareDistribution\ReportingEvents.log" },
-    @{ Rel = "Windows\System32\catroot2"; Dest = "offline\Windows\System32\catroot2" },
-    @{ Rel = "Windows\Minidump"; Dest = "offline\Windows\Minidump" },
-    @{ Rel = "Windows\MEMORY.DMP"; Dest = "offline\Windows\MEMORY.DMP" },
-    @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs" }
+    @{ Rel = "Windows\System32\winevt\Logs"; Dest = "offline\winevt\Logs"; Activity = "Event logs" },
+    @{ Rel = "Windows\Logs\CBS"; Dest = "offline\Windows\Logs\CBS"; Activity = "CBS logs" },
+    @{ Rel = "Windows\Logs\DISM"; Dest = "offline\Windows\Logs\DISM"; Activity = "DISM logs" },
+    @{ Rel = "Windows\Panther"; Dest = "offline\Windows\Panther"; Activity = "Panther setup logs" },
+    @{ Rel = "Windows\INF\setupapi.dev.log"; Dest = "offline\Windows\INF\setupapi.dev.log"; Activity = "Setupapi device log" },
+    @{ Rel = "Windows\INF\setupapi.setup.log"; Dest = "offline\Windows\INF\setupapi.setup.log"; Activity = "Setupapi setup log" },
+    @{ Rel = "Windows\SoftwareDistribution\ReportingEvents.log"; Dest = "offline\Windows\SoftwareDistribution\ReportingEvents.log"; Activity = "Windows Update reporting" },
+    @{ Rel = "Windows\System32\catroot2"; Dest = "offline\Windows\System32\catroot2"; Activity = "Catroot2 catalog" },
+    @{ Rel = "Windows\Minidump"; Dest = "offline\Windows\Minidump"; Activity = "Minidumps" },
+    @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs"; Activity = "USO shared logs" }
 )
 
+$itemCount = 0
+$totalItems = $pathsToCollect.Count
+
 foreach ($item in $pathsToCollect) {
+    $itemCount++
     $sourcePath = Join-Path $offlineRoot $item.Rel
     $destPath = Join-Path $outputFolder $item.Dest
-    Copy-IfPresent -Source $sourcePath -Destination $destPath
+    $activity = if ($item.Activity) { $item.Activity } else { "Offline files" }
+
+    Write-Progress -Id 0 -Activity "Collecting offline diagnostics" -Status "($itemCount of $totalItems) $activity" -PercentComplete (($itemCount / $totalItems) * 100)
+    Copy-IfPresent -Source $sourcePath -Destination $destPath -Activity $activity -ProgressId 1
+}
+
+Write-Progress -Id 0 -Activity "Collecting offline diagnostics" -Completed
+
+# MEMORY.DMP — opt-in only (large + may contain in-memory secrets)
+if ($IncludeMemoryDump) {
+    $dumpPath = Join-Path $offlineRoot "Windows\MEMORY.DMP"
+    if (Test-Path -LiteralPath $dumpPath) {
+        $dumpItem = Get-Item -LiteralPath $dumpPath
+        $dumpSizeGB = [math]::Round($dumpItem.Length / 1GB, 2)
+
+        Write-Warning "⚠️  MEMORY DUMP: Collecting MEMORY.DMP ($dumpSizeGB GB)"
+        Write-Warning "    This file is large and may contain in-memory secrets (credentials, encryption keys)."
+        Write-Warning "    Only include if explicitly required for crash analysis."
+
+        $destPath = Join-Path $outputFolder "offline\Windows\MEMORY.DMP"
+        Copy-IfPresent -Source $dumpPath -Destination $destPath -Activity "Memory dump ($dumpSizeGB GB)" -ProgressId 1
+    }
+    else {
+        Write-Host "[skip] MEMORY.DMP not found (expected if no crash occurred)" -ForegroundColor DarkYellow
+    }
 }
 
 if ($IncludeRegistryHives) {
     $hiveFolder = Join-Path $resolvedWindowsRoot "System32\config"
-    
+
     # Core diagnostic hives (safe for support bundles)
     $safeHives = @("SYSTEM", "SOFTWARE", "COMPONENTS")
-    
+
     foreach ($hive in $safeHives) {
         $sourceHive = Join-Path $hiveFolder $hive
         $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
-        Copy-IfPresent -Source $sourceHive -Destination $destHive
+        Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Registry hive: $hive" -ProgressId 1
     }
-    
+
     # Credential-bearing hives (requires explicit consent)
     if ($IncludeCredentialHives) {
         Write-Warning "⚠️  CREDENTIAL HIVES: Collecting SAM, SECURITY, and DEFAULT registry hives."
         Write-Warning "    These hives contain sensitive credential material (password hashes, LSA secrets, DPAPI data)."
         Write-Warning "    Only collect these if explicitly required for your troubleshooting scenario."
-        
+
         $credentialHives = @("SAM", "SECURITY", "DEFAULT")
         foreach ($hive in $credentialHives) {
             $sourceHive = Join-Path $hiveFolder $hive
             $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
-            Copy-IfPresent -Source $sourceHive -Destination $destHive
+            Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Credential hive: $hive" -ProgressId 1
         }
     }
 }
 
-if ([string]::IsNullOrWhiteSpace($TssPath)) {
-    $candidate = Join-Path $PSScriptRoot "TSS\TSS.ps1"
-    Write-Host "[tss] -TssPath not provided. Checking default path: $candidate" -ForegroundColor Yellow
-
-    if (Test-Path -LiteralPath $candidate) {
-        $TssPath = (Resolve-Path $candidate).Path
-        Write-Host "[tss] Found default TSS script: $TssPath" -ForegroundColor Green
-    }
-    else {
-        Write-Host "[tss] Default TSS script was not found: $candidate" -ForegroundColor Red
-        Write-Host "[tss] Expected layout:" -ForegroundColor Yellow
-        Write-Host "       $PSScriptRoot" -ForegroundColor Yellow
-        Write-Host "       $PSScriptRoot\TSS\TSS.ps1" -ForegroundColor Yellow
-        Write-Host "[tss] Action: unzip the TSS folder in the same directory as this wrapper, or provide -TssPath explicitly." -ForegroundColor Yellow
-        throw "-TssPath was not provided and wrapper-local default was not found: $candidate"
+# Generate manifest
+Write-Host "[manifest] Generating collection manifest..." -ForegroundColor Cyan
+$manifestPath = Join-Path $outputFolder "manifest.json"
+$manifest = @{
+    CollectionTime = (Get-Date).ToUniversalTime().ToString("o")
+    OfflineWindowsRoot = $resolvedWindowsRoot
+    OfflineDiskRoot = $offlineRoot
+    OutputFolder = $outputFolder
+    Parameters = @{
+        IncludeRegistryHives = $IncludeRegistryHives.IsPresent
+        IncludeCredentialHives = $IncludeCredentialHives.IsPresent
+        IncludeMemoryDump = $IncludeMemoryDump.IsPresent
     }
+    Files = $script:manifestEntries
 }
+$manifest | ConvertTo-Json -Depth 10 | Out-File -LiteralPath $manifestPath -Encoding UTF8 -Force
+Write-Host "[manifest] Manifest saved: $manifestPath" -ForegroundColor Green
 
-$effectiveTssArgs = @()
-if ($TssArguments -and $TssArguments.Count -gt 0) {
-    $effectiveTssArgs = $TssArguments
-}
-elseif (-not [string]::IsNullOrWhiteSpace($TssCollectLog)) {
-    $effectiveTssArgs = @("-CollectLog", $TssCollectLog)
-}
-else {
-    $effectiveTssArgs = @("-SDP", "Setup")
-}
-
-Run-OptionalTss -Path $TssPath -Arguments $effectiveTssArgs -AutoAcceptEula:(-not $NoAcceptEula)
+# Stop transcript before zip/final output
+Stop-Transcript | Out-Null
 
 if ($ZipOutput) {
     $zipPath = "$outputFolder.zip"
@@ -396,6 +465,14 @@ if ($ZipOutput) {
     Write-Host "Zip created: $zipPath" -ForegroundColor Green
 }
 
-Write-Host "Offline rescue collection complete." -ForegroundColor Green
-Write-Host "Data location: $outputRoot" -ForegroundColor Green
-Write-Host "Bundle path: $outputFolder" -ForegroundColor Green
+# Collection summary
+$copiedCount = ($script:manifestEntries | Where-Object { $_.Status -eq "Copied" }).Count
+$skippedCount = ($script:manifestEntries | Where-Object { $_.Status -match "^(Missing|Failed)" }).Count
+$totalSize = ($script:manifestEntries | Where-Object { $_.Status -eq "Copied" } | Measure-Object -Property SizeBytes -Sum).Sum
+$totalSizeGB = [math]::Round($totalSize / 1GB, 2)
+
+Write-Host "`nOffline collection complete." -ForegroundColor Green
+Write-Host "  Copied  : $copiedCount items ($totalSizeGB GB)" -ForegroundColor Green
+Write-Host "  Skipped : $skippedCount items" -ForegroundColor Yellow
+Write-Host "  Bundle  : $outputFolder" -ForegroundColor Cyan
+Write-Host "  Manifest: $manifestPath" -ForegroundColor Cyan
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 870f441..1c173df 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -1,116 +1,105 @@
 # TSS Offline Log Collector
 
-This PowerShell script is for rescue-VM scenarios where the broken VM OS disk is attached offline to a working rescue VM. It collects offline Windows troubleshooting logs from the attached disk and then runs TSS in the rescue VM context.
+PowerShell script for rescue-VM scenarios that collects Windows troubleshooting logs from an offline (broken) VM OS disk attached to a working rescue VM.
 
-## What It Does
+## Design
 
-1. **Offline Log Collection**
-   - Copies offline Windows troubleshooting logs from the attached disk (event logs, CBS, DISM, Panther, setupapi, Software Distribution, catroot2, USO logs, and optional registry hives).
+**Pure offline static file collection** — this script collects diagnostic files from the attached broken disk only. It does NOT run TSS.ps1 or execute any live diagnostics. This is intentional: TSS.ps1 requires a running OS and cannot operate on offline disks.
 
-2. **TSS Execution**
-   - Always runs TSS on the rescue VM context.
-   - Uses default TSS mode `-SDP Setup` when no explicit TSS arguments are provided.
-   - Supports explicit `-TssCollectLog` or full pass-through `-TssArguments`.
+## What It Collects
 
-3. **Output Packaging**
-   - Writes to fixed output root `C:\MS_DATA\TSS_PERF_OFFLINE`.
-   - Optionally creates a zip of the run folder.
+- Event logs (`winevt\Logs`)
+- Windows Update / servicing logs (CBS, DISM, setupapi, WindowsUpdate.log, ReportingEvents.log)
+- Setup logs (Panther)
+- Certificate catalog (catroot2)
+- USO (Update Session Orchestrator) logs
+- Crash dumps (minidumps, optionally MEMORY.DMP with `-IncludeMemoryDump`)
+- Registry hives (optional with `-IncludeRegistryHives`):
+  - Safe diagnostic hives by default: SYSTEM, SOFTWARE, COMPONENTS
+  - Credential-bearing hives with explicit consent (`-IncludeCredentialHives`): SAM, SECURITY, DEFAULT
 
-## Prerequisites
-
-- PowerShell 5.1 or higher.
-- **Run from an elevated (Run as administrator) PowerShell console.**
-- **Must run in the standard PowerShell console host (`ConsoleHost`), not PowerShell ISE.**
-- The broken VM OS disk must already be attached to the rescue VM.
-
-## TSS Folder Expectation (Default)
-
-If `-TssPath` is not provided, the script expects:
-
-```text
-<wrapper-folder>\TSS\TSS.ps1
-```
-
-Example:
+## Output
 
-```text
-RunCommand\Windows\TSSOfflineRescueWrapper\Invoke-TSSOfflineRescueWrapper.ps1
-RunCommand\Windows\TSSOfflineRescueWrapper\TSS\TSS.ps1
-```
+- **Chain-of-custody manifest** (`manifest.json`) — lists all collected/skipped files with size and SHA-256 hash
+- **Self-transcript** (`wrapper-transcript.log`) — complete log of the wrapper's execution
+- Optional zip bundle (`-ZipOutput`)
 
-If not present, the script prints screen guidance and stops.
+## Prerequisites
 
-Disk selection note: `-Disk 2` in examples is sample syntax. Replace `2` with the disk number that contains the offline OS.
+- PowerShell 5.1 or higher
+- **Run from an elevated (Run as administrator) PowerShell console**
+- The broken VM OS disk must already be attached to the rescue VM
 
 ## Usage
 
-From an elevated PowerShell console, in the directory that contains the script:
+From an elevated PowerShell console:
 
 ```powershell
 Set-ExecutionPolicy Bypass -Force
 ```
 
-## Quick Start
-
-### Default is Setup/Perf Report
+### Basic collection (disk 2 has the offline OS)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2
 ```
 
-### DND setup report
+### With registry hives (safe diagnostic hives only)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssCollectLog DND_SetupReport -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeRegistryHives -ZipOutput
 ```
 
-### UEX Report
+### With MEMORY.DMP (if crash analysis is required)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-UEX_RDSsrv') -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeMemoryDump -ZipOutput
 ```
 
-### Directory Services (DS) report
+### ⚠️ With credential-bearing registry hives (use with caution)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -TssArguments @('-SDP','Dom') -ZipOutput
+# Only use when explicitly required for troubleshooting
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeRegistryHives -IncludeCredentialHives -ZipOutput
 ```
 
-### With registry hives (safe diagnostic hives only)
+### Custom output path
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -IncludeRegistryHives -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -OutputPath "D:\DiagnosticCollections" -ZipOutput
 ```
 
-### ⚠️ With credential-bearing registry hives (use with caution)
+### Dry-run preview (no actual copy)
 ```powershell
-# Only use when explicitly required for troubleshooting
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -TssPath C:\Tools\TSS\TSS.ps1 -IncludeRegistryHives -IncludeCredentialHives -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -WhatIf
 ```
 
 ## Parameters
 
 - `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
 - `-Disk <number|drive>`: Disk selector, supports disk number (`2`) or drive (`E`, `E:`, `E:\`).
-- `-TssPath <path>`: Optional explicit path to `TSS.ps1`. If omitted, wrapper-local default is used.
-- `-TssCollectLog <name>`: Optional override to run `-CollectLog <name>`.
-- `-TssArguments <string[]>`: Any TSS args passed as-is.
+- `-OutputPath <path>`: Override default output root (`C:\MS_DATA\TSS_PERF_OFFLINE`).
 - `-IncludeRegistryHives`: Include safe diagnostic registry hives (SYSTEM, SOFTWARE, COMPONENTS).
 - `-IncludeCredentialHives`: **⚠️ SECURITY SENSITIVE** — Include credential-bearing hives (SAM, SECURITY, DEFAULT). Requires `-IncludeRegistryHives`. These hives contain password hashes, LSA secrets, and DPAPI material. Only use when explicitly required for troubleshooting.
-- `-NoAcceptEula`: Prevent automatic `-AcceptEula` append.
+- `-IncludeMemoryDump`: **⚠️ LARGE + SENSITIVE** — Include MEMORY.DMP (may be several GB and contain in-memory secrets). Only use when explicitly required for crash analysis.
 - `-ZipOutput`: Create zip after collection.
 - `-Force`: Allow overwrite when output folder already exists.
+- `-WhatIf`: Preview what would be collected without actually copying files.
 
 ## Output
 
-- Root: `C:\MS_DATA\TSS_PERF_OFFLINE`
-- Run folder: `offline-tss-wrapper-<timestamp>`
-- Optional zip: `offline-tss-wrapper-<timestamp>.zip`
+- **Default root**: `C:\MS_DATA\TSS_PERF_OFFLINE` (override with `-OutputPath`)
+- **Run folder**: `offline-tss-wrapper-<timestamp>`
+- **Manifest**: `manifest.json` (lists all collected/skipped files with size and SHA-256)
+- **Transcript**: `wrapper-transcript.log` (complete execution log)
+- **Optional zip**: `offline-tss-wrapper-<timestamp>.zip` (with `-ZipOutput`)
 
 ## Notes
 
-- If neither `-TssArguments` nor `-TssCollectLog` is provided, wrapper defaults to `-SDP Setup`.
-- `-SDP Perf` is deprecated in current TSS; use `-SDP Setup`.
-- DS (Directory Services) SDP key is `Dom` in TSS (`-SDP Dom`).
+- This wrapper collects **static files only** from the offline disk. It does not run TSS.ps1 or any live diagnostics.
+- MEMORY.DMP is opt-in (`-IncludeMemoryDump`) because it can be several GB and may contain in-memory secrets.
+- Credential-bearing registry hives (SAM/SECURITY/DEFAULT) require explicit consent (`-IncludeCredentialHives`) to prevent accidental exposure of password hashes and LSA secrets.
+- Use `-WhatIf` to preview what would be collected without actually copying files.
+- The manifest (`manifest.json`) provides chain-of-custody documentation for all collected artifacts.
 
 ## Known Issues
 
-- TSS SDP collection must run in the standard PowerShell console host. Running directly inside PowerShell ISE fails because the SDP module depends on console-host-only properties. Use a standard elevated PowerShell console, or invoke with `powershell -ExecutionPolicy Bypass -File <script>` which launches a fresh console host.
+None currently.
 
 ## Liability
 

From 2c30c6e6d84d93382625e667ada7ad95a29dc048 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:20:33 -0500
Subject: [PATCH 13/17] Registry hives now always collected by default

- Removed -IncludeRegistryHives parameter
- Safe diagnostic hives (SYSTEM, SOFTWARE, COMPONENTS) now collected automatically
- Credential-bearing hives still require explicit -IncludeCredentialHives switch
- Updated readme to reflect registry hives are always included
- Updated manifest generation to remove obsolete parameter

Rationale: Registry hives are essential for proper troubleshooting in rescue scenarios. Making them always-on eliminates the need to remember the switch and ensures complete diagnostic data collection.
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 43 ++++++++-----------
 .../Windows/TSSOfflineRescueWrapper/readme.md | 17 +++-----
 2 files changed, 25 insertions(+), 35 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index 1fef8c3..c414f92 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -9,9 +9,6 @@ param(
     [Parameter(Mandatory = $false)]
     [string]$OutputPath,
 
-    [Parameter(Mandatory = $false)]
-    [switch]$IncludeRegistryHives,
-
     [Parameter(Mandatory = $false)]
     [switch]$IncludeCredentialHives,
 
@@ -407,30 +404,29 @@ if ($IncludeMemoryDump) {
     }
 }
 
-if ($IncludeRegistryHives) {
-    $hiveFolder = Join-Path $resolvedWindowsRoot "System32\config"
+# Registry hive collection (always included - required for proper troubleshooting)
+$hiveFolder = Join-Path $resolvedWindowsRoot "System32\config"
+
+# Core diagnostic hives (safe for support bundles)
+$safeHives = @("SYSTEM", "SOFTWARE", "COMPONENTS")
+
+foreach ($hive in $safeHives) {
+    $sourceHive = Join-Path $hiveFolder $hive
+    $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
+    Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Registry hive: $hive" -ProgressId 1
+}
 
-    # Core diagnostic hives (safe for support bundles)
-    $safeHives = @("SYSTEM", "SOFTWARE", "COMPONENTS")
+# Credential-bearing hives (requires explicit consent)
+if ($IncludeCredentialHives) {
+    Write-Warning "⚠️  CREDENTIAL HIVES: Collecting SAM, SECURITY, and DEFAULT registry hives."
+    Write-Warning "    These hives contain sensitive credential material (password hashes, LSA secrets, DPAPI data)."
+    Write-Warning "    Only collect these if explicitly required for your troubleshooting scenario."
 
-    foreach ($hive in $safeHives) {
+    $credentialHives = @("SAM", "SECURITY", "DEFAULT")
+    foreach ($hive in $credentialHives) {
         $sourceHive = Join-Path $hiveFolder $hive
         $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
-        Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Registry hive: $hive" -ProgressId 1
-    }
-
-    # Credential-bearing hives (requires explicit consent)
-    if ($IncludeCredentialHives) {
-        Write-Warning "⚠️  CREDENTIAL HIVES: Collecting SAM, SECURITY, and DEFAULT registry hives."
-        Write-Warning "    These hives contain sensitive credential material (password hashes, LSA secrets, DPAPI data)."
-        Write-Warning "    Only collect these if explicitly required for your troubleshooting scenario."
-
-        $credentialHives = @("SAM", "SECURITY", "DEFAULT")
-        foreach ($hive in $credentialHives) {
-            $sourceHive = Join-Path $hiveFolder $hive
-            $destHive = Join-Path $outputFolder ("offline\registry\{0}" -f $hive)
-            Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Credential hive: $hive" -ProgressId 1
-        }
+        Copy-IfPresent -Source $sourceHive -Destination $destHive -Activity "Credential hive: $hive" -ProgressId 1
     }
 }
 
@@ -443,7 +439,6 @@ $manifest = @{
     OfflineDiskRoot = $offlineRoot
     OutputFolder = $outputFolder
     Parameters = @{
-        IncludeRegistryHives = $IncludeRegistryHives.IsPresent
         IncludeCredentialHives = $IncludeCredentialHives.IsPresent
         IncludeMemoryDump = $IncludeMemoryDump.IsPresent
     }
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 1c173df..a6428c2 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -14,8 +14,8 @@ PowerShell script for rescue-VM scenarios that collects Windows troubleshooting
 - Certificate catalog (catroot2)
 - USO (Update Session Orchestrator) logs
 - Crash dumps (minidumps, optionally MEMORY.DMP with `-IncludeMemoryDump`)
-- Registry hives (optional with `-IncludeRegistryHives`):
-  - Safe diagnostic hives by default: SYSTEM, SOFTWARE, COMPONENTS
+- **Registry hives** (always collected):
+  - Safe diagnostic hives: SYSTEM, SOFTWARE, COMPONENTS
   - Credential-bearing hives with explicit consent (`-IncludeCredentialHives`): SAM, SECURITY, DEFAULT
 
 ## Output
@@ -40,12 +40,7 @@ Set-ExecutionPolicy Bypass -Force
 
 ### Basic collection (disk 2 has the offline OS)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2
-```
-
-### With registry hives (safe diagnostic hives only)
-```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeRegistryHives -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -ZipOutput
 ```
 
 ### With MEMORY.DMP (if crash analysis is required)
@@ -56,7 +51,7 @@ Set-ExecutionPolicy Bypass -Force
 ### ⚠️ With credential-bearing registry hives (use with caution)
 ```powershell
 # Only use when explicitly required for troubleshooting
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeRegistryHives -IncludeCredentialHives -ZipOutput
+.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeCredentialHives -ZipOutput
 ```
 
 ### Custom output path
@@ -74,8 +69,7 @@ Set-ExecutionPolicy Bypass -Force
 - `-OfflineWindowsRoot <path>`: Offline Windows directory (example `F:\Windows`).
 - `-Disk <number|drive>`: Disk selector, supports disk number (`2`) or drive (`E`, `E:`, `E:\`).
 - `-OutputPath <path>`: Override default output root (`C:\MS_DATA\TSS_PERF_OFFLINE`).
-- `-IncludeRegistryHives`: Include safe diagnostic registry hives (SYSTEM, SOFTWARE, COMPONENTS).
-- `-IncludeCredentialHives`: **⚠️ SECURITY SENSITIVE** — Include credential-bearing hives (SAM, SECURITY, DEFAULT). Requires `-IncludeRegistryHives`. These hives contain password hashes, LSA secrets, and DPAPI material. Only use when explicitly required for troubleshooting.
+- `-IncludeCredentialHives`: **⚠️ SECURITY SENSITIVE** — Include credential-bearing hives (SAM, SECURITY, DEFAULT) in addition to the always-collected safe hives (SYSTEM, SOFTWARE, COMPONENTS). These hives contain password hashes, LSA secrets, and DPAPI material. Only use when explicitly required for troubleshooting.
 - `-IncludeMemoryDump`: **⚠️ LARGE + SENSITIVE** — Include MEMORY.DMP (may be several GB and contain in-memory secrets). Only use when explicitly required for crash analysis.
 - `-ZipOutput`: Create zip after collection.
 - `-Force`: Allow overwrite when output folder already exists.
@@ -92,6 +86,7 @@ Set-ExecutionPolicy Bypass -Force
 ## Notes
 
 - This wrapper collects **static files only** from the offline disk. It does not run TSS.ps1 or any live diagnostics.
+- **Registry hives are always collected** (SYSTEM, SOFTWARE, COMPONENTS) — these are essential for proper troubleshooting.
 - MEMORY.DMP is opt-in (`-IncludeMemoryDump`) because it can be several GB and may contain in-memory secrets.
 - Credential-bearing registry hives (SAM/SECURITY/DEFAULT) require explicit consent (`-IncludeCredentialHives`) to prevent accidental exposure of password hashes and LSA secrets.
 - Use `-WhatIf` to preview what would be collected without actually copying files.

From 3262ac94659af911d22a99d4297b28227507aec9 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:34:41 -0500
Subject: [PATCH 14/17] Expand collection to comprehensive TSS.ps1
 DND_SetupReport/SDP Setup equivalent

Added 30+ collection paths to match TSS.ps1 static file collection:

**Windows Update & Servicing:**
- Complete Windows\Logs\WindowsUpdate folder (was missing)
- Full SoftwareDistribution folder (was only ReportingEvents.log)
- WinSxS pending.xml and poqexec.log
- Windows\servicing\Sessions
- USOPrivate\UpdateStore
- Windows\Logs\MoSetup (Modern Setup)

**Setup & Upgrade:**
- \.~BT\Sources\Panther (setup source)
- Windows\System32\Sysprep\Panther

**Drivers:**
- Complete Windows\INF folder (was only two setupapi logs)
- Windows\System32\DriverStore\FileRepository
- Windows\Logs\DPX (device setup)

**Error Reporting & Diagnostics:**
- ProgramData\Microsoft\Windows\WER (Windows Error Reporting)
- Windows\LiveKernelReports
- Windows\System32\LogFiles (system logs)
- Windows\Performance\WinSAT
- Windows\Temp

**System Configuration:**
- Windows\System32\spp\store (activation/licensing)
- Windows\System32\Tasks + Windows\Tasks (scheduled tasks)
- Windows\System32\LogFiles\Firewall

**Security:**
- ProgramData\Microsoft\Windows Defender\Support

Collection now comprehensive for Windows Update, setup, driver, and servicing troubleshooting scenarios. Expect larger collection size (several hundred MB to GB depending on system state).

Updated readme to reflect expanded scope and collection size expectations.
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 53 +++++++++++++++++--
 .../Windows/TSSOfflineRescueWrapper/readme.md | 23 +++++---
 2 files changed, 65 insertions(+), 11 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index c414f92..eef1aed 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -357,17 +357,62 @@ Write-Host "Output folder        : $outputFolder" -ForegroundColor Green
 Write-Host "Transcript           : $transcriptPath" -ForegroundColor Green
 
 # Collect a practical offline bundle aligned with Windows Update / DnD troubleshooting.
+# Comprehensive offline collection aligned with TSS.ps1 DND_SetupReport / SDP Setup
 $pathsToCollect = @(
+    # Event logs
     @{ Rel = "Windows\System32\winevt\Logs"; Dest = "offline\winevt\Logs"; Activity = "Event logs" },
+    
+    # Windows Update and servicing logs
     @{ Rel = "Windows\Logs\CBS"; Dest = "offline\Windows\Logs\CBS"; Activity = "CBS logs" },
     @{ Rel = "Windows\Logs\DISM"; Dest = "offline\Windows\Logs\DISM"; Activity = "DISM logs" },
+    @{ Rel = "Windows\Logs\WindowsUpdate"; Dest = "offline\Windows\Logs\WindowsUpdate"; Activity = "Windows Update logs" },
+    @{ Rel = "Windows\SoftwareDistribution"; Dest = "offline\Windows\SoftwareDistribution"; Activity = "SoftwareDistribution" },
+    @{ Rel = "Windows\WinSxS\pending.xml"; Dest = "offline\Windows\WinSxS\pending.xml"; Activity = "WinSxS pending" },
+    @{ Rel = "Windows\WinSxS\poqexec.log"; Dest = "offline\Windows\WinSxS\poqexec.log"; Activity = "WinSxS poqexec" },
+    @{ Rel = "Windows\servicing\Sessions"; Dest = "offline\Windows\servicing\Sessions"; Activity = "Servicing sessions" },
+    @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs"; Activity = "USO shared logs" },
+    @{ Rel = "ProgramData\USOPrivate\UpdateStore"; Dest = "offline\ProgramData\USOPrivate\UpdateStore"; Activity = "USO private store" },
+    
+    # Setup and upgrade logs
     @{ Rel = "Windows\Panther"; Dest = "offline\Windows\Panther"; Activity = "Panther setup logs" },
-    @{ Rel = "Windows\INF\setupapi.dev.log"; Dest = "offline\Windows\INF\setupapi.dev.log"; Activity = "Setupapi device log" },
-    @{ Rel = "Windows\INF\setupapi.setup.log"; Dest = "offline\Windows\INF\setupapi.setup.log"; Activity = "Setupapi setup log" },
-    @{ Rel = "Windows\SoftwareDistribution\ReportingEvents.log"; Dest = "offline\Windows\SoftwareDistribution\ReportingEvents.log"; Activity = "Windows Update reporting" },
+    @{ Rel = "$Windows.~BT\Sources\Panther"; Dest = "offline\Windows.~BT\Sources\Panther"; Activity = "Setup source Panther" },
+    @{ Rel = "Windows\System32\Sysprep\Panther"; Dest = "offline\Windows\System32\Sysprep\Panther"; Activity = "Sysprep Panther" },
+    
+    # INF and driver installation logs
+    @{ Rel = "Windows\INF"; Dest = "offline\Windows\INF"; Activity = "INF and setupapi logs" },
+    @{ Rel = "Windows\System32\DriverStore\FileRepository"; Dest = "offline\Windows\System32\DriverStore\FileRepository"; Activity = "Driver store repository" },
+    
+    # Certificate and crypto
     @{ Rel = "Windows\System32\catroot2"; Dest = "offline\Windows\System32\catroot2"; Activity = "Catroot2 catalog" },
+    
+    # Windows Error Reporting
+    @{ Rel = "ProgramData\Microsoft\Windows\WER"; Dest = "offline\ProgramData\Microsoft\Windows\WER"; Activity = "Windows Error Reporting" },
+    
+    # Crash dumps
     @{ Rel = "Windows\Minidump"; Dest = "offline\Windows\Minidump"; Activity = "Minidumps" },
-    @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs"; Activity = "USO shared logs" }
+    @{ Rel = "Windows\LiveKernelReports"; Dest = "offline\Windows\LiveKernelReports"; Activity = "Live kernel reports" },
+    
+    # System logs and diagnostics
+    @{ Rel = "Windows\System32\LogFiles"; Dest = "offline\Windows\System32\LogFiles"; Activity = "System32 LogFiles" },
+    @{ Rel = "Windows\Performance\WinSAT"; Dest = "offline\Windows\Performance\WinSAT"; Activity = "WinSAT performance" },
+    @{ Rel = "Windows\Temp"; Dest = "offline\Windows\Temp"; Activity = "Windows Temp" },
+    
+    # Activation and licensing
+    @{ Rel = "Windows\System32\spp\store"; Dest = "offline\Windows\System32\spp\store"; Activity = "Software Protection Platform" },
+    
+    # Windows Defender (if present)
+    @{ Rel = "ProgramData\Microsoft\Windows Defender\Support"; Dest = "offline\ProgramData\Microsoft\Windows Defender\Support"; Activity = "Windows Defender logs" },
+    
+    # Task Scheduler logs
+    @{ Rel = "Windows\System32\Tasks"; Dest = "offline\Windows\System32\Tasks"; Activity = "Scheduled tasks" },
+    @{ Rel = "Windows\Tasks"; Dest = "offline\Windows\Tasks"; Activity = "Legacy tasks" },
+    
+    # Network and firewall (static config)
+    @{ Rel = "Windows\System32\LogFiles\Firewall"; Dest = "offline\Windows\System32\LogFiles\Firewall"; Activity = "Firewall logs" },
+    
+    # Additional servicing and component store
+    @{ Rel = "Windows\Logs\MoSetup"; Dest = "offline\Windows\Logs\MoSetup"; Activity = "Modern Setup logs" },
+    @{ Rel = "Windows\Logs\DPX"; Dest = "offline\Windows\Logs\DPX"; Activity = "Device setup logs" }
 )
 
 $itemCount = 0
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index a6428c2..5a39d54 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -8,12 +8,19 @@ PowerShell script for rescue-VM scenarios that collects Windows troubleshooting
 
 ## What It Collects
 
-- Event logs (`winevt\Logs`)
-- Windows Update / servicing logs (CBS, DISM, setupapi, WindowsUpdate.log, ReportingEvents.log)
-- Setup logs (Panther)
-- Certificate catalog (catroot2)
-- USO (Update Session Orchestrator) logs
-- Crash dumps (minidumps, optionally MEMORY.DMP with `-IncludeMemoryDump`)
+**Comprehensive offline diagnostic collection** (aligned with TSS.ps1 DND_SetupReport / SDP Setup):
+
+- **Event logs** — All event logs from `winevt\Logs`
+- **Windows Update & Servicing** — CBS, DISM, WindowsUpdate logs, SoftwareDistribution, WinSxS pending/servicing, USO logs
+- **Setup & Upgrade** — Panther logs (Windows, $Windows.~BT, Sysprep), Modern Setup (MoSetup)
+- **Drivers** — Complete INF folder (setupapi logs), DriverStore repository, DPX device setup logs
+- **Certificates** — catroot2 certificate catalog
+- **Error Reporting** — Windows Error Reporting (WER) logs and reports
+- **Crash Analysis** — Minidumps, LiveKernelReports, optionally MEMORY.DMP with `-IncludeMemoryDump`
+- **System Diagnostics** — System32\LogFiles, WinSAT performance, Windows Temp
+- **Activation & Licensing** — Software Protection Platform (SPP) store
+- **Security** — Windows Defender logs (if present), Firewall logs
+- **Task Scheduler** — Scheduled tasks configuration and logs
 - **Registry hives** (always collected):
   - Safe diagnostic hives: SYSTEM, SOFTWARE, COMPONENTS
   - Credential-bearing hives with explicit consent (`-IncludeCredentialHives`): SAM, SECURITY, DEFAULT
@@ -86,11 +93,13 @@ Set-ExecutionPolicy Bypass -Force
 ## Notes
 
 - This wrapper collects **static files only** from the offline disk. It does not run TSS.ps1 or any live diagnostics.
+- **Comprehensive collection** — collects all diagnostic files TSS.ps1 DND_SetupReport/SDP Setup would gather (event logs, servicing logs, driver store, WER, etc.)
+- **Collection size** — expect several hundred MB to several GB depending on system state (more if DriverStore/WER contain many files). Use `-WhatIf` to preview before collecting.
 - **Registry hives are always collected** (SYSTEM, SOFTWARE, COMPONENTS) — these are essential for proper troubleshooting.
 - MEMORY.DMP is opt-in (`-IncludeMemoryDump`) because it can be several GB and may contain in-memory secrets.
 - Credential-bearing registry hives (SAM/SECURITY/DEFAULT) require explicit consent (`-IncludeCredentialHives`) to prevent accidental exposure of password hashes and LSA secrets.
 - Use `-WhatIf` to preview what would be collected without actually copying files.
-- The manifest (`manifest.json`) provides chain-of-custody documentation for all collected artifacts.
+- The manifest (`manifest.json`) provides chain-of-custody documentation for all collected artifacts with SHA-256 hashes.
 
 ## Known Issues
 

From de0cdd3e40fd59156b8711f40b77dbfd16da82b0 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:37:14 -0500
Subject: [PATCH 15/17] Add legacy WindowsUpdate.log collection and clarify ETL
 vs readable log

- Added Windows\WindowsUpdate.log for Windows 7/8/Server 2012 R2 and earlier
- Already collecting Windows\Logs\WindowsUpdate (ETL files for Win10+)
- Updated readme to clarify:
  * ETL files are collected (source data)
  * Get-WindowsUpdateLog must be run on a live system to generate readable log
  * Legacy WindowsUpdate.log is collected for older OS versions

Users can run Get-WindowsUpdateLog after bringing system online or on the rescue VM with the collected ETL files to generate the human-readable WindowsUpdate.log.
---
 .../Invoke-TSSOfflineRescueWrapper.ps1        | 25 ++++++++++---------
 .../Windows/TSSOfflineRescueWrapper/readme.md |  3 ++-
 2 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
index eef1aed..d71c7be 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
@@ -361,55 +361,56 @@ Write-Host "Transcript           : $transcriptPath" -ForegroundColor Green
 $pathsToCollect = @(
     # Event logs
     @{ Rel = "Windows\System32\winevt\Logs"; Dest = "offline\winevt\Logs"; Activity = "Event logs" },
-    
+
     # Windows Update and servicing logs
     @{ Rel = "Windows\Logs\CBS"; Dest = "offline\Windows\Logs\CBS"; Activity = "CBS logs" },
     @{ Rel = "Windows\Logs\DISM"; Dest = "offline\Windows\Logs\DISM"; Activity = "DISM logs" },
     @{ Rel = "Windows\Logs\WindowsUpdate"; Dest = "offline\Windows\Logs\WindowsUpdate"; Activity = "Windows Update logs" },
+    @{ Rel = "Windows\WindowsUpdate.log"; Dest = "offline\Windows\WindowsUpdate.log"; Activity = "WindowsUpdate.log (legacy)" },
     @{ Rel = "Windows\SoftwareDistribution"; Dest = "offline\Windows\SoftwareDistribution"; Activity = "SoftwareDistribution" },
     @{ Rel = "Windows\WinSxS\pending.xml"; Dest = "offline\Windows\WinSxS\pending.xml"; Activity = "WinSxS pending" },
     @{ Rel = "Windows\WinSxS\poqexec.log"; Dest = "offline\Windows\WinSxS\poqexec.log"; Activity = "WinSxS poqexec" },
     @{ Rel = "Windows\servicing\Sessions"; Dest = "offline\Windows\servicing\Sessions"; Activity = "Servicing sessions" },
     @{ Rel = "ProgramData\USOShared\Logs"; Dest = "offline\ProgramData\USOShared\Logs"; Activity = "USO shared logs" },
     @{ Rel = "ProgramData\USOPrivate\UpdateStore"; Dest = "offline\ProgramData\USOPrivate\UpdateStore"; Activity = "USO private store" },
-    
+
     # Setup and upgrade logs
     @{ Rel = "Windows\Panther"; Dest = "offline\Windows\Panther"; Activity = "Panther setup logs" },
     @{ Rel = "$Windows.~BT\Sources\Panther"; Dest = "offline\Windows.~BT\Sources\Panther"; Activity = "Setup source Panther" },
     @{ Rel = "Windows\System32\Sysprep\Panther"; Dest = "offline\Windows\System32\Sysprep\Panther"; Activity = "Sysprep Panther" },
-    
+
     # INF and driver installation logs
     @{ Rel = "Windows\INF"; Dest = "offline\Windows\INF"; Activity = "INF and setupapi logs" },
     @{ Rel = "Windows\System32\DriverStore\FileRepository"; Dest = "offline\Windows\System32\DriverStore\FileRepository"; Activity = "Driver store repository" },
-    
+
     # Certificate and crypto
     @{ Rel = "Windows\System32\catroot2"; Dest = "offline\Windows\System32\catroot2"; Activity = "Catroot2 catalog" },
-    
+
     # Windows Error Reporting
     @{ Rel = "ProgramData\Microsoft\Windows\WER"; Dest = "offline\ProgramData\Microsoft\Windows\WER"; Activity = "Windows Error Reporting" },
-    
+
     # Crash dumps
     @{ Rel = "Windows\Minidump"; Dest = "offline\Windows\Minidump"; Activity = "Minidumps" },
     @{ Rel = "Windows\LiveKernelReports"; Dest = "offline\Windows\LiveKernelReports"; Activity = "Live kernel reports" },
-    
+
     # System logs and diagnostics
     @{ Rel = "Windows\System32\LogFiles"; Dest = "offline\Windows\System32\LogFiles"; Activity = "System32 LogFiles" },
     @{ Rel = "Windows\Performance\WinSAT"; Dest = "offline\Windows\Performance\WinSAT"; Activity = "WinSAT performance" },
     @{ Rel = "Windows\Temp"; Dest = "offline\Windows\Temp"; Activity = "Windows Temp" },
-    
+
     # Activation and licensing
     @{ Rel = "Windows\System32\spp\store"; Dest = "offline\Windows\System32\spp\store"; Activity = "Software Protection Platform" },
-    
+
     # Windows Defender (if present)
     @{ Rel = "ProgramData\Microsoft\Windows Defender\Support"; Dest = "offline\ProgramData\Microsoft\Windows Defender\Support"; Activity = "Windows Defender logs" },
-    
+
     # Task Scheduler logs
     @{ Rel = "Windows\System32\Tasks"; Dest = "offline\Windows\System32\Tasks"; Activity = "Scheduled tasks" },
     @{ Rel = "Windows\Tasks"; Dest = "offline\Windows\Tasks"; Activity = "Legacy tasks" },
-    
+
     # Network and firewall (static config)
     @{ Rel = "Windows\System32\LogFiles\Firewall"; Dest = "offline\Windows\System32\LogFiles\Firewall"; Activity = "Firewall logs" },
-    
+
     # Additional servicing and component store
     @{ Rel = "Windows\Logs\MoSetup"; Dest = "offline\Windows\Logs\MoSetup"; Activity = "Modern Setup logs" },
     @{ Rel = "Windows\Logs\DPX"; Dest = "offline\Windows\Logs\DPX"; Activity = "Device setup logs" }
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 5a39d54..895d553 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -11,7 +11,8 @@ PowerShell script for rescue-VM scenarios that collects Windows troubleshooting
 **Comprehensive offline diagnostic collection** (aligned with TSS.ps1 DND_SetupReport / SDP Setup):
 
 - **Event logs** — All event logs from `winevt\Logs`
-- **Windows Update & Servicing** — CBS, DISM, WindowsUpdate logs, SoftwareDistribution, WinSxS pending/servicing, USO logs
+- **Windows Update & Servicing** — CBS, DISM, WindowsUpdate ETL trace files (Windows 10+) and WindowsUpdate.log (legacy OS), SoftwareDistribution, WinSxS pending/servicing, USO logs
+  - *Note: On Windows 10+, use `Get-WindowsUpdateLog` on a running system to generate human-readable log from collected ETL files*
 - **Setup & Upgrade** — Panther logs (Windows, $Windows.~BT, Sysprep), Modern Setup (MoSetup)
 - **Drivers** — Complete INF folder (setupapi logs), DriverStore repository, DPX device setup logs
 - **Certificates** — catroot2 certificate catalog

From 39c829c31fbcfba06a7cc7838ae7be453094b271 Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:48:56 -0500
Subject: [PATCH 16/17] Rename script to tssofflinelogcollector.ps1 to reflect
 its purpose

- Renamed Invoke-TSSOfflineRescueWrapper.ps1 -> tssofflinelogcollector.ps1
- Updated all script references in readme.md
- Better reflects what the script does: offline log collection (not a wrapper around TSS.ps1)
---
 RunCommand/Windows/TSSOfflineRescueWrapper/readme.md   | 10 +++++-----
 ...ineRescueWrapper.ps1 => tssofflinelogcollector.ps1} |  0
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename RunCommand/Windows/TSSOfflineRescueWrapper/{Invoke-TSSOfflineRescueWrapper.ps1 => tssofflinelogcollector.ps1} (100%)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
index 895d553..1ec005c 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/readme.md
@@ -48,28 +48,28 @@ Set-ExecutionPolicy Bypass -Force
 
 ### Basic collection (disk 2 has the offline OS)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -ZipOutput
+.\tssofflinelogcollector.ps1 -Disk 2 -ZipOutput
 ```
 
 ### With MEMORY.DMP (if crash analysis is required)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeMemoryDump -ZipOutput
+.\tssofflinelogcollector.ps1 -Disk 2 -IncludeMemoryDump -ZipOutput
 ```
 
 ### ⚠️ With credential-bearing registry hives (use with caution)
 ```powershell
 # Only use when explicitly required for troubleshooting
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -IncludeCredentialHives -ZipOutput
+.\tssofflinelogcollector.ps1 -Disk 2 -IncludeCredentialHives -ZipOutput
 ```
 
 ### Custom output path
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -OutputPath "D:\DiagnosticCollections" -ZipOutput
+.\tssofflinelogcollector.ps1 -Disk 2 -OutputPath "D:\DiagnosticCollections" -ZipOutput
 ```
 
 ### Dry-run preview (no actual copy)
 ```powershell
-.\Invoke-TSSOfflineRescueWrapper.ps1 -Disk 2 -WhatIf
+.\tssofflinelogcollector.ps1 -Disk 2 -WhatIf
 ```
 
 ## Parameters
diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1
similarity index 100%
rename from RunCommand/Windows/TSSOfflineRescueWrapper/Invoke-TSSOfflineRescueWrapper.ps1
rename to RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1

From 035063370f86edc269e72a0c9ded4c9edeaa7c1a Mon Sep 17 00:00:00 2001
From: jdickson289 <jdickson289@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:51:10 -0500
Subject: [PATCH 17/17] Fix directory creation logic for custom OutputPath

- Only check/create MS_DATA root when using default path
- Prevents undefined variable error when -OutputPath is specified
- Script already creates C:\MS_DATA\TSS_PERF_OFFLINE by default (matching TSS.ps1 behavior)
---
 .../TSSOfflineRescueWrapper/tssofflinelogcollector.ps1    | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1 b/RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1
index d71c7be..6605733 100644
--- a/RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1
+++ b/RunCommand/Windows/TSSOfflineRescueWrapper/tssofflinelogcollector.ps1
@@ -330,10 +330,14 @@ $offlineRoot = Split-Path -Parent $resolvedWindowsRoot
 $offlineRoot = if ([string]::IsNullOrWhiteSpace($offlineRoot)) { Split-Path -Qualifier $resolvedWindowsRoot } else { $offlineRoot }
 $timeStamp = Get-Date -Format "yyyyMMdd-HHmmss-fff"
 
-if (-not (Test-Path -LiteralPath $msDataRoot)) {
-    New-Item -Path $msDataRoot -ItemType Directory -Force | Out-Null
+# Create MS_DATA root folder (if using default path)
+if ([string]::IsNullOrWhiteSpace($OutputPath)) {
+    if (-not (Test-Path -LiteralPath $msDataRoot)) {
+        New-Item -Path $msDataRoot -ItemType Directory -Force | Out-Null
+    }
 }
 
+# Create output root folder (default C:\MS_DATA\TSS_PERF_OFFLINE or custom path)
 if (-not (Test-Path -LiteralPath $outputRoot)) {
     New-Item -Path $outputRoot -ItemType Directory -Force | Out-Null
 }