# check-defender.ps1 - Check Windows Defender status

Write-Host "Windows Defender Status Check" -ForegroundColor Cyan
Write-Host "==============================`n" -ForegroundColor Cyan

# Check Real-Time Protection
try {
    $mpPref = Get-MpPreference -ErrorAction SilentlyContinue
    if ($mpPref.DisableRealtimeMonitoring) {
        Write-Host "[X] Real-time protection: DISABLED" -ForegroundColor Red
    } else {
        Write-Host "[!] Real-time protection: ENABLED" -ForegroundColor Yellow
    }
} catch {
    Write-Host "[X] Windows Defender not responding" -ForegroundColor Red
}

# Check Services
Write-Host "`nServices:" -ForegroundColor Cyan
$services = @("WinDefend", "SecurityHealthService", "wscsvc")
foreach ($svc in $services) {
    $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($service) {
        $status = if ($service.Status -eq "Running") { "RUNNING" } else { "STOPPED" }
        $color = if ($service.Status -eq "Running") { "Yellow" } else { "Red" }
        Write-Host "  $($svc): $status" -ForegroundColor $color
    }
}

# Check Registry
Write-Host "`nRegistry Settings:" -ForegroundColor Cyan
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
if (Test-Path $regPath) {
    $disabled = Get-ItemProperty -Path $regPath -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue
    if ($disabled.DisableAntiSpyware -eq 1) {
        Write-Host "  DisableAntiSpyware: SET (Defender disabled)" -ForegroundColor Red
    } else {
        Write-Host "  DisableAntiSpyware: NOT SET" -ForegroundColor Yellow
    }
}

# Check Firewall
Write-Host "`nFirewall:" -ForegroundColor Cyan
$profiles = Get-NetFirewallProfile
foreach ($profile in $profiles) {
    $status = if ($profile.Enabled) { "ON" } else { "OFF" }
    $color = if ($profile.Enabled) { "Yellow" } else { "Red" }
    Write-Host "  $($profile.Name): $status" -ForegroundColor $color
}