Technical reference

Read-only first: safer PowerShell on production PCs

Audit before you change, keep a recovery archive, check every exit code, and prove the result afterward.

Owner-reported findings. Published Oct 26, 2026. Reviewed Oct 26, 2026.

The principle

On a machine that touches air, the first script you run should change nothing. These habits come from the master control PC audit and migration work.

1. Audit read-only

Collect the state of the machine before you plan anything: installed software, services, scheduled tasks, network settings, registry exports. Package it with a hash manifest so you can prove later what you collected and that it wasn’t altered.

2. Keep a recovery archive

Before any cutover, take a full archive of what you’re about to replace. Selective migration is the plan; the archive is for everything the plan missed.

3. Check prerequisites and exit codes

  • Confirm the files, paths, and permissions a script needs before it starts making changes.
  • Check the exit code of every external process. A script that keeps going after a failed step makes the next failure harder to understand.
  • Log every action to one place, with a timestamp.

4. No destructive defaults

A script should do nothing harmful when run with no arguments. Make the risky part explicit.

5. Prove the result

A completed script isn’t a working system. Check the thing the change was for: the app launches, the service answers, the media mounts.