Evidence from the responsible subsystems

Before you start

You are handed one Windows endpoint — WIN-LAB04 — and asked to produce a single machine-readable evidence bundle an auditor can read against SOC 2 CC6: disk encryption, endpoint-protection posture, the effective screen-lock setting, recent failed sign-ins, and who holds local administrator rights. Then make the whole thing re-runnable, so the same machine can be re-evidenced next quarter and compared. This console is a simulated Windows PowerShell 5.1 session. No real PowerShell engine exists for the browser, so every output here is produced by an object pipeline that follows PowerShell's documented formatting rules and this module's own committed lab fixtures — and where the simulation has a boundary, it says so in plain text instead of pretending to be Windows.