Use this pack weekly and compare outputs over time.
Get-LocalGroupMember -Group "Administrators"`nSearch-ADAccount -LockedOut -UsersOnly`nSearch-ADAccount -AccountDisabled -UsersOnly`nGet-ADUser -Filter * -Properties LastLogonDate | Sort LastLogonDate`nGet-WinEvent -FilterHashtable @{LogName='Security';Id=4625;StartTime=(Get-Date).AddDays(-1)}`nGet-WinEvent -FilterHashtable @{LogName='Security';Id=4688;StartTime=(Get-Date).AddHours(-6)}`nGet-NetTCPConnection -State Established`nGet-Process | Sort CPU -Descending | Select -First 20 Name,CPU`nGet-Service | ? Status -eq 'Running'`nGet-FileHash C:\Windows\System32\notepad.exe -Algorithm SHA256`nGet-ChildItem C:\Temp -Recurse -File | ? LastWriteTime -gt (Get-Date).AddDays(-1)`nGet-History