Update Powershell/README.md

Powershell/README.md

@@ -19,6 +19,138 @@ Launch the menu on local machine:
 
 You’ll be prompted step-by-step to list or create tasks, including remote targeting.
 
+---
+---
+
+<h2>Invoke-DiskCleanupScan.ps1</h2>
+`Invoke-DiskCleanupScan.ps1` is a PowerShell script for recovering disk space on Windows Server 2016 through current versions. It performs a full scan of the C: drive across all known bloat sources, presents a grouped findings report with sizes, then requires explicit user confirmation before touching anything.
+
+Supports: **Windows Server 2016, 2019, 2022, 2025**
+Requires: **Run as Administrator**
+
+---
+
+## Features
+
+- Full pre/post drive capacity reporting
+- Grouped scan results with colour-coded size indicators
+- Interactive cleanup mode — clean all, pick individually, or exit
+- **Event log backup to Zipline (pebkac.pro) before any wipe**
+- IIS log cleanup scoped to files older than 30 days
+- Delivery Optimisation cache cleanup with safe service stop/start
+- PS 5.1 compatible — no PowerShell 7 required
+
+---
+
+## What It Scans
+
+| Category | Target |
+|---|---|
+| Temp Files | `C:\Windows\Temp`, `$env:TEMP`, User AppData Temp |
+| Windows Update | `SoftwareDistribution\Download`, `WinSxS\Backup` |
+| System Logs | `C:\Windows\Logs\CBS` |
+| Error Reporting | WER ReportQueue, ReportArchive, User WER folder |
+| Crash Dumps | `C:\Windows\Minidump`, `MEMORY.DMP` |
+| Prefetch | `C:\Windows\Prefetch` (*.pf files) |
+| Delivery Optimisation | SoftwareDistribution\DeliveryOptimization, NetworkService profile cache |
+| IIS Logs | `C:\inetpub\logs\LogFiles`, `W3SVC1` (files >30 days) |
+| Windows Event Logs | All `.evtx` logs — **backed up before wipe** |
+| Recycle Bin | C: Recycle Bin via Shell COM object |
+| Cache | Thumbnail cache, Font cache |
+| Installer | MSI Patch Cache ⚠️ |
+| User Profiles | Non-system profiles in `C:\Users` ⚠️ |
+| Legacy | Downloaded Program Files |
+
+> ⚠️ **MSI Patch Cache** — deleting may break MSI repair/uninstall for some applications. Only select this if space is critical and you have installer media available.
+
+> ⚠️ **Old User Profiles** — script flags these for review. Manual verification is strongly recommended before selecting.
+
+---
+
+## Event Log Backup — Zipline Integration
+
+Before any event log is cleared, the script automatically:
+
+1. Exports all non-empty event logs to `.evtx` files in a temp staging folder
+2. Compresses them into a single zip: `HOSTNAME_EventLogs_YYYYMMDD-HHmmss.zip`
+3. Uploads the zip to **pebkac.pro** via the Zipline API
+4. **Only clears logs if the upload returns HTTP 200/201/204**
+5. If upload fails for any reason — logs are NOT wiped, and the local export path is printed
+
+The file URL returned by Zipline is printed to console for reference.
+
+**Upload endpoint:** `https://pebkac.pro/api/upload`
+**Auth header:** `authorization: <token>` (bare token, no `Bearer` prefix — Zipline-specific)
+**Extra header:** `x-zipline-original-name: true`
+**Response field:** `.files[0].url`
+
+---
+
+## Usage
+
+```powershell
+# Run in an elevated PowerShell session
+Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
+.\Invoke-DiskCleanupScan.ps1
+```
+
+### Cleanup Menu
+
+```
+  [A] Clean ALL items listed above
+  [S] Select items individually
+  [X] Exit — do nothing
+```
+
+- Choosing **A** requires typing `YES` in full to confirm
+- Choosing **S** prompts Y/N per item
+- All confirmations require input in the console — nothing runs silently
+
+---
+
+## Output Example
+
+```
+  C: Drive Status
+  ────────────────────────────────────────────────────────────
+  Total: 120.00 GB   Used: 108.42 GB   Free: 11.58 GB  (9.7% free)
+
+  [Windows Update]
+  ────────────────────────────────────────────────────────────
+  SoftwareDistribution\Download                        3.21 GB  (Cached WU downloads)
+  WinSxS\Backup                                      512.00 MB  (Old component backups)
+
+  [Event Logs]
+  ────────────────────────────────────────────────────────────
+  Windows Event Logs (*.evtx)                          1.84 GB  (Will clear all logs — review first)
+
+  ...
+
+  TOTAL RECOVERABLE                                    9.10 GB
+```
+
+---
+
+## Notes & Caveats
+
+- **Event logs**: All logs are cleared when selected. The Zipline backup is the safety net — don't skip it or remove that gate.
+- **IIS logs**: Only files older than 30 days are removed. Adjust the `$cutoff` variable in the script if you need a different retention window.
+- **Prefetch**: Windows Server typically has Prefetch disabled by default. The script will skip this silently if no `.pf` files are found.
+- **WinSxS**: The script removes `WinSxS\Backup` only — it does not touch the main WinSxS store. Running `DISM /Online /Cleanup-Image /StartComponentCleanup` separately is recommended for deeper WinSxS reduction but requires a maintenance window.
+- **Delivery Optimisation**: The `DoSvc` service is stopped briefly during cleanup and restarted. If the server is actively downloading updates this may cause a minor interruption.
+
+---
+
+## Script Location
+
+Store the script in a consistent admin tools location, e.g.:
+
+```
+\\<server>\AdminTools\Scripts\Invoke-DiskCleanupScan.ps1
+```
+
+Or maintain in your preferred source control / internal repo.
+
 <h2>Everything Else</h2>
 
 Still working documenting this crap