#Requires -RunAsAdministrator
<#
.SYNOPSIS
    BluetechGreen Windows Login Diagnostic Tool
.DESCRIPTION
    Analyzes Windows login performance, Group Policy processing,
    network connectivity, and system health. Generates an HTML report
    on the current user's Desktop.
.NOTES
    Version:  1.0
    Author:   BluetechGreen LLC
    Website:  https://bluetechgreen.com
    License:  Free for use. Redistribution permitted with attribution.
.EXAMPLE
    .\BTG-LoginDiag.ps1
    Run from an elevated PowerShell prompt. Report opens automatically on completion.
#>

[CmdletBinding()]
param()

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Continue'
$ScriptStart = Get-Date

# ─── Helpers ───────────────────────────────────────────────────────────────────

function Write-Status {
    param([string]$Message, [string]$Color = 'Cyan')
    Write-Host "  [BTG] $Message" -ForegroundColor $Color
}

function Safe-Invoke {
    param([scriptblock]$Block, [string]$Section)
    try { & $Block }
    catch {
        Write-Status "WARNING: Section '$Section' encountered an error: $($_.Exception.Message)" 'Yellow'
        $null
    }
}

function Format-Ms {
    param([double]$Milliseconds)
    if ($Milliseconds -ge 60000) { return "{0:N1} min" -f ($Milliseconds / 60000) }
    if ($Milliseconds -ge 1000)  { return "{0:N1} s"   -f ($Milliseconds / 1000) }
    return "{0:N0} ms" -f $Milliseconds
}

function Severity-Class {
    param([double]$ValueMs, [double]$WarnMs, [double]$CritMs)
    if ($ValueMs -ge $CritMs) { return 'sev-red'    }
    if ($ValueMs -ge $WarnMs) { return 'sev-yellow' }
    return 'sev-green'
}

# ─── Section 1 — Login / Boot Time Analysis ────────────────────────────────────

Write-Status "Collecting login time data..."

$LoginData = Safe-Invoke -Section 'LoginTime' -Block {
    $results = @{
        BootEvents     = @()
        GpEvents       = @()
        ProfileEvents  = @()
        BootMs         = 0
        GpMs           = 0
        ProfileMs      = 0
    }

    # Boot performance — Event ID 100 in Diagnostics-Performance
    $bootEvents = Get-WinEvent -LogName 'Microsoft-Windows-Diagnostics-Performance/Operational' `
        -FilterXPath "*[System[EventID=100]]" -MaxEvents 10 -ErrorAction SilentlyContinue

    foreach ($evt in $bootEvents) {
        $xml  = [xml]$evt.ToXml()
        $ns   = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
        $ns.AddNamespace('e', 'http://schemas.microsoft.com/win/2004/08/events/event')
        $bootMs = try { [double]($xml.SelectSingleNode('//e:Data[@Name="BootTsMs"]', $ns).'#text') } catch { 0 }
        $mainPathMs = try { [double]($xml.SelectSingleNode('//e:Data[@Name="MainPathBootTime"]', $ns).'#text') } catch { 0 }
        $results.BootEvents += [PSCustomObject]@{
            Time     = $evt.TimeCreated
            BootMs   = $bootMs
            MainMs   = $mainPathMs
        }
    }
    if ($results.BootEvents.Count -gt 0) {
        $results.BootMs = ($results.BootEvents | Measure-Object BootMs -Average).Average
    }

    # Group Policy processing
    $gpEvents = Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' `
        -FilterXPath "*[System[EventID=8001 or EventID=8004]]" -MaxEvents 20 -ErrorAction SilentlyContinue

    foreach ($evt in $gpEvents) {
        $xml = [xml]$evt.ToXml()
        $ns  = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
        $ns.AddNamespace('e', 'http://schemas.microsoft.com/win/2004/08/events/event')
        $durationMs = try { [double]($xml.SelectSingleNode('//e:Data[@Name="PolicyElaspedTimeInMilliSeconds"]', $ns).'#text') } catch { 0 }
        $results.GpEvents += [PSCustomObject]@{
            Time       = $evt.TimeCreated
            EventId    = $evt.Id
            DurationMs = $durationMs
            Message    = ($evt.Message -replace '[\r\n]+', ' ') | Select-Object -First 1
        }
    }
    if ($results.GpEvents.Count -gt 0) {
        $results.GpMs = ($results.GpEvents | Measure-Object DurationMs -Average).Average
    }

    # User Profile Service — Event ID 1
    $profEvents = Get-WinEvent -LogName 'Microsoft-Windows-User Profile Service/Operational' `
        -MaxEvents 20 -ErrorAction SilentlyContinue | Where-Object { $_.Id -in @(1, 2, 67) }

    foreach ($evt in $profEvents) {
        $results.ProfileEvents += [PSCustomObject]@{
            Time    = $evt.TimeCreated
            EventId = $evt.Id
            Level   = $evt.LevelDisplayName
            Message = ($evt.Message -replace '[\r\n]+', ' ').Substring(0, [Math]::Min(120, $evt.Message.Length))
        }
    }
    if ($results.ProfileEvents.Count -gt 0) {
        $results.ProfileMs = 3500  # estimated; direct timing not available without ETW
    }

    $results
}

# ─── Section 2 — Group Policy Analysis ────────────────────────────────────────

Write-Status "Analyzing Group Policy..."

$GpData = Safe-Invoke -Section 'GroupPolicy' -Block {
    $results = @{ AppliedGpos = @(); SlowGpos = @() }

    # RSoP — fastest non-privileged enumeration
    $rsopQuery = Get-WmiObject -Namespace 'root\rsop\computer' `
        -Class RSOP_GPO -ErrorAction SilentlyContinue

    if ($rsopQuery) {
        foreach ($gpo in $rsopQuery) {
            $results.AppliedGpos += [PSCustomObject]@{
                Name       = $gpo.Name
                Guid       = $gpo.GpoId
                Version    = $gpo.Version
                Enabled    = $gpo.Enabled
            }
        }
    }

    # Parse GP extension timings from event log
    $gpExtEvents = Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' `
        -FilterXPath "*[System[EventID=5312 or EventID=5313]]" -MaxEvents 100 -ErrorAction SilentlyContinue

    $extTimes = @{}
    foreach ($evt in $gpExtEvents) {
        $xml = [xml]$evt.ToXml()
        $ns  = New-Object System.Xml.XmlNamespaceManager($xml.NameTable)
        $ns.AddNamespace('e', 'http://schemas.microsoft.com/win/2004/08/events/event')
        $extName = try { $xml.SelectSingleNode('//e:Data[@Name="ExtensionName"]', $ns).'#text' } catch { $null }
        $elapsedMs = try { [double]($xml.SelectSingleNode('//e:Data[@Name="ElapsedTimeInMilliSeconds"]', $ns).'#text') } catch { 0 }
        if ($extName -and $elapsedMs -gt 0) {
            if (-not $extTimes.ContainsKey($extName) -or $extTimes[$extName] -lt $elapsedMs) {
                $extTimes[$extName] = $elapsedMs
            }
        }
    }

    $results.SlowGpos = $extTimes.GetEnumerator() |
        Sort-Object Value -Descending |
        Select-Object -First 10 |
        ForEach-Object { [PSCustomObject]@{ Extension = $_.Key; MaxMs = $_.Value } }

    $results
}

# ─── Section 3 — Network Diagnostics ──────────────────────────────────────────

Write-Status "Running network diagnostics..."

$NetData = Safe-Invoke -Section 'Network' -Block {
    $results = @{ DnsTimes = @(); GatewayPing = $null; DcResults = @(); LdapPorts = @() }

    # Discover domain and DC
    $domainName = try { [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().DomainName } catch { '' }
    $gatewayIp  = try {
        (Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue |
            Sort-Object RouteMetric | Select-Object -First 1).NextHop
    } catch { $null }

    # DNS resolution timing
    $dnsTargets = @('www.google.com')
    if ($domainName) { $dnsTargets += $domainName }

    foreach ($target in $dnsTargets) {
        $sw = [System.Diagnostics.Stopwatch]::StartNew()
        $resolved = try { [System.Net.Dns]::GetHostAddresses($target); $true } catch { $false }
        $sw.Stop()
        $results.DnsTimes += [PSCustomObject]@{
            Target     = $target
            ResolvedMs = $sw.ElapsedMilliseconds
            Success    = $resolved
        }
    }

    # Gateway ping
    if ($gatewayIp) {
        $ping = New-Object System.Net.NetworkInformation.Ping
        $replies = 1..4 | ForEach-Object {
            try { $ping.Send($gatewayIp, 1000) } catch { $null }
        }
        $successful = $replies | Where-Object { $_ -and $_.Status -eq 'Success' }
        $results.GatewayPing = [PSCustomObject]@{
            Gateway    = $gatewayIp
            Sent       = 4
            Received   = @($successful).Count
            AvgMs      = if (@($successful).Count -gt 0) { ($successful | Measure-Object RoundtripTime -Average).Average } else { 9999 }
        }
    }

    # DC connectivity
    if ($domainName) {
        $dcAddrs = try { [System.Net.Dns]::GetHostAddresses("_ldap._tcp.dc._msdcs.$domainName") } catch {
            try { [System.Net.Dns]::GetHostAddresses($domainName) } catch { @() }
        }
        foreach ($addr in ($dcAddrs | Select-Object -First 3)) {
            $dcIp = $addr.IPAddressToString
            $sw   = [System.Diagnostics.Stopwatch]::StartNew()
            $ping = New-Object System.Net.NetworkInformation.Ping
            $reply = try { $ping.Send($dcIp, 2000) } catch { $null }
            $sw.Stop()
            $results.DcResults += [PSCustomObject]@{
                Address = $dcIp
                PingMs  = if ($reply -and $reply.Status -eq 'Success') { $reply.RoundtripTime } else { 9999 }
                Online  = ($reply -and $reply.Status -eq 'Success')
            }
        }
    }

    # LDAP port checks (389, 636)
    foreach ($port in @(389, 636)) {
        if ($results.DcResults.Count -gt 0) {
            $dc = $results.DcResults[0].Address
            $sw = [System.Diagnostics.Stopwatch]::StartNew()
            $tcp = try {
                $client = New-Object System.Net.Sockets.TcpClient
                $task   = $client.ConnectAsync($dc, $port)
                $open   = $task.Wait(2000) -and $client.Connected
                $client.Close()
                $open
            } catch { $false }
            $sw.Stop()
            $results.LdapPorts += [PSCustomObject]@{
                Port    = $port
                Open    = $tcp
                CheckMs = $sw.ElapsedMilliseconds
                Label   = if ($port -eq 389) { 'LDAP (389)' } else { 'LDAPS (636)' }
            }
        }
    }

    $results
}

# ─── Section 4 — Event Log Analysis ───────────────────────────────────────────

Write-Status "Scanning event logs..."

$EventData = Safe-Invoke -Section 'EventLogs' -Block {
    $results = @{ SysErrors = @(); AppErrors = @(); SecWarnings = @(); SourceSummary = @{} }

    # System errors
    $sysErrors = Get-WinEvent -LogName System -MaxEvents 200 -ErrorAction SilentlyContinue |
        Where-Object { $_.Level -eq 2 } | Select-Object -First 50

    foreach ($e in $sysErrors) {
        $results.SysErrors += [PSCustomObject]@{
            Time    = $e.TimeCreated.ToString('yyyy-MM-dd HH:mm')
            Source  = $e.ProviderName
            Id      = $e.Id
            Message = ($e.Message -replace '[\r\n]+', ' ').Substring(0, [Math]::Min(100, $e.Message.Length))
        }
        $src = $e.ProviderName
        if (-not $results.SourceSummary.ContainsKey($src)) { $results.SourceSummary[$src] = 0 }
        $results.SourceSummary[$src]++
    }

    # Application errors
    $appErrors = Get-WinEvent -LogName Application -MaxEvents 200 -ErrorAction SilentlyContinue |
        Where-Object { $_.Level -eq 2 } | Select-Object -First 50

    foreach ($e in $appErrors) {
        $results.AppErrors += [PSCustomObject]@{
            Time    = $e.TimeCreated.ToString('yyyy-MM-dd HH:mm')
            Source  = $e.ProviderName
            Id      = $e.Id
            Message = ($e.Message -replace '[\r\n]+', ' ').Substring(0, [Math]::Min(100, $e.Message.Length))
        }
        $src = $e.ProviderName
        if (-not $results.SourceSummary.ContainsKey($src)) { $results.SourceSummary[$src] = 0 }
        $results.SourceSummary[$src]++
    }

    # Security warnings
    $secWarnings = Get-WinEvent -LogName Security -MaxEvents 100 -ErrorAction SilentlyContinue |
        Where-Object { $_.Level -in @(3, 2) } | Select-Object -First 20

    foreach ($e in $secWarnings) {
        $results.SecWarnings += [PSCustomObject]@{
            Time    = $e.TimeCreated.ToString('yyyy-MM-dd HH:mm')
            Source  = $e.ProviderName
            Id      = $e.Id
            Level   = $e.LevelDisplayName
        }
    }

    $results
}

# ─── Section 5 — System Information ───────────────────────────────────────────

Write-Status "Gathering system info..."

$SysInfo = Safe-Invoke -Section 'SystemInfo' -Block {
    $os   = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue
    $cpu  = Get-CimInstance Win32_Processor       -ErrorAction SilentlyContinue | Select-Object -First 1
    $disk = Get-CimInstance Win32_LogicalDisk     -Filter "DeviceID='C:'" -ErrorAction SilentlyContinue
    $ram  = Get-CimInstance Win32_PhysicalMemory  -ErrorAction SilentlyContinue |
                Measure-Object Capacity -Sum

    $startup = try {
        (Get-CimInstance Win32_StartupCommand -ErrorAction SilentlyContinue | Measure-Object).Count
    } catch { 0 }

    $uptime = if ($os) { (Get-Date) - $os.LastBootUpTime } else { $null }

    [PSCustomObject]@{
        OsName       = if ($os) { $os.Caption }            else { 'Unknown' }
        OsBuild      = if ($os) { $os.BuildNumber }        else { 'Unknown' }
        OsVersion    = if ($os) { $os.Version }            else { 'Unknown' }
        Architecture = if ($os) { $os.OSArchitecture }     else { 'Unknown' }
        LastBoot     = if ($os) { $os.LastBootUpTime.ToString('yyyy-MM-dd HH:mm') } else { 'Unknown' }
        UptimeDays   = if ($uptime) { [Math]::Round($uptime.TotalDays, 1) } else { 0 }
        CpuName      = if ($cpu) { $cpu.Name }             else { 'Unknown' }
        CpuCores     = if ($cpu) { $cpu.NumberOfCores }    else { 0 }
        CpuLoad      = if ($cpu) { $cpu.LoadPercentage }   else { 0 }
        RamTotalGb   = if ($ram.Sum) { [Math]::Round($ram.Sum / 1GB, 1) } else { 0 }
        DiskTotalGb  = if ($disk) { [Math]::Round($disk.Size / 1GB, 1) }  else { 0 }
        DiskFreeGb   = if ($disk) { [Math]::Round($disk.FreeSpace / 1GB, 1) } else { 0 }
        DiskFreePct  = if ($disk -and $disk.Size -gt 0) { [Math]::Round(($disk.FreeSpace / $disk.Size) * 100, 1) } else { 0 }
        StartupCount = $startup
    }
}

# ─── Section 6 — SCCM / Intune Detection ─────────────────────────────────────

Write-Status "Checking SCCM and Intune enrollment..."

$MgmtData = Safe-Invoke -Section 'Management' -Block {
    $results = @{ SccmInstalled = $false; SccmVersion = ''; IntuneEnrolled = $false; IntuneDetails = '' }

    # SCCM / ConfigMgr Client
    $ccmClient = Get-WmiObject -Namespace 'root\ccm' -Class SMS_Client -ErrorAction SilentlyContinue
    if ($ccmClient) {
        $results.SccmInstalled = $true
        $results.SccmVersion   = $ccmClient.ClientVersion
    } elseif (Test-Path 'C:\Windows\CCM\CcmExec.exe') {
        $results.SccmInstalled = $true
        $exe = Get-Item 'C:\Windows\CCM\CcmExec.exe' -ErrorAction SilentlyContinue
        $results.SccmVersion = if ($exe) { $exe.VersionInfo.FileVersion } else { 'Found (version unavailable)' }
    }

    # Intune enrollment detection
    $intuneKey = 'HKLM:\SOFTWARE\Microsoft\Enrollments'
    if (Test-Path $intuneKey) {
        $enrollments = Get-ChildItem $intuneKey -ErrorAction SilentlyContinue |
            Get-ItemProperty -ErrorAction SilentlyContinue |
            Where-Object { $_.ProviderID -like '*Intune*' -or $_.EnrollmentType -eq 6 }
        if ($enrollments) {
            $results.IntuneEnrolled = $true
            $first = $enrollments | Select-Object -First 1
            $results.IntuneDetails = "UPN: $($first.UPN)"
        }
    }

    # Also check AAD join / hybrid join status
    $dsregOutput = try { dsregcmd /status 2>$null } catch { $null }
    if ($dsregOutput) {
        $azureAdJoined   = $dsregOutput | Select-String 'AzureAdJoined\s*:\s*YES' | Select-Object -First 1
        $domainJoined    = $dsregOutput | Select-String 'DomainJoined\s*:\s*YES'   | Select-Object -First 1
        $mdmEnrolled     = $dsregOutput | Select-String 'MDMEnrolled\s*:\s*YES'    | Select-Object -First 1

        $results.AadJoined    = $null -ne $azureAdJoined
        $results.DomainJoined = $null -ne $domainJoined
        $results.MdmEnrolled  = $null -ne $mdmEnrolled
        if ($null -ne $mdmEnrolled) { $results.IntuneEnrolled = $true }
    }

    $results
}

# ─── Build Recommendations ────────────────────────────────────────────────────

Write-Status "Building recommendations..."

$Recommendations = @()

if ($LoginData -and $LoginData.BootMs -gt 90000) {
    $Recommendations += @{ Level = 'red'; Text = "Average boot time is $(Format-Ms $LoginData.BootMs). Target is under 60 seconds. Review startup applications and consider SSD upgrade." }
} elseif ($LoginData -and $LoginData.BootMs -gt 60000) {
    $Recommendations += @{ Level = 'yellow'; Text = "Boot time of $(Format-Ms $LoginData.BootMs) is above the 60-second target. Review startup items and GP processing times." }
}

if ($GpData -and $GpData.SlowGpos.Count -gt 0) {
    $slowest = $GpData.SlowGpos | Select-Object -First 1
    if ($slowest.MaxMs -gt 5000) {
        $Recommendations += @{ Level = 'red'; Text = "GP extension '$($slowest.Extension)' took $(Format-Ms $slowest.MaxMs). Extensions taking over 5 seconds significantly delay login. Review scripts and mapped drives." }
    }
}

if ($NetData -and $NetData.GatewayPing -and $NetData.GatewayPing.AvgMs -gt 10) {
    $Recommendations += @{ Level = 'yellow'; Text = "Gateway latency of $([Math]::Round($NetData.GatewayPing.AvgMs))ms detected. High LAN latency can delay GP processing and profile load." }
}

if ($NetData -and $NetData.DnsTimes) {
    $slowDns = $NetData.DnsTimes | Where-Object { $_.ResolvedMs -gt 500 }
    foreach ($d in $slowDns) {
        $Recommendations += @{ Level = 'yellow'; Text = "DNS resolution for '$($d.Target)' took $($d.ResolvedMs)ms. Slow DNS directly delays domain authentication." }
    }
    $failedDns = $NetData.DnsTimes | Where-Object { -not $_.Success }
    foreach ($d in $failedDns) {
        $Recommendations += @{ Level = 'red'; Text = "DNS resolution FAILED for '$($d.Target)'. This will prevent domain authentication and GP processing." }
    }
}

if ($SysInfo -and $SysInfo.DiskFreePct -lt 15) {
    $Recommendations += @{ Level = 'red'; Text = "C: drive is $($SysInfo.DiskFreePct)% free ($($SysInfo.DiskFreeGb) GB). Low disk space causes profile write failures and slow logins." }
} elseif ($SysInfo -and $SysInfo.DiskFreePct -lt 25) {
    $Recommendations += @{ Level = 'yellow'; Text = "C: drive is $($SysInfo.DiskFreePct)% free. Consider disk cleanup to maintain healthy login performance." }
}

if ($SysInfo -and $SysInfo.UptimeDays -gt 30) {
    $Recommendations += @{ Level = 'yellow'; Text = "System uptime is $($SysInfo.UptimeDays) days. Extended uptime can accumulate stale GP objects. Schedule a reboot." }
}

if ($SysInfo -and $SysInfo.StartupCount -gt 15) {
    $Recommendations += @{ Level = 'yellow'; Text = "$($SysInfo.StartupCount) startup programs detected. Excess startup items significantly slow login times." }
}

if ($EventData -and ($EventData.SysErrors.Count + $EventData.AppErrors.Count) -gt 30) {
    $Recommendations += @{ Level = 'yellow'; Text = "$(($EventData.SysErrors + $EventData.AppErrors).Count) errors found in System/Application logs. High error rates may indicate underlying issues causing login delays." }
}

if ($Recommendations.Count -eq 0) {
    $Recommendations += @{ Level = 'green'; Text = "No critical issues detected. Login performance appears healthy." }
}

# ─── HTML Report Generation ───────────────────────────────────────────────────

Write-Status "Generating HTML report..."

$ScriptEnd    = Get-Date
$RunDuration  = [Math]::Round(($ScriptEnd - $ScriptStart).TotalSeconds, 1)
$ReportDate   = $ScriptStart.ToString('yyyy-MM-dd HH:mm')
$ReportFile   = Join-Path ([Environment]::GetFolderPath('Desktop')) ("LoginDiag-Report-" + $ScriptStart.ToString('yyyyMMdd-HHmm') + ".html")

# Build table rows ─────────────────────────────────────────────────────────────

function Html-TableRows {
    param([array]$Items, [string[]]$Props)
    if (-not $Items -or $Items.Count -eq 0) { return '<tr><td colspan="99" style="color:rgba(255,255,255,.4);font-style:italic">No data collected</td></tr>' }
    $rows = ''
    foreach ($item in $Items) {
        $rows += '<tr>'
        foreach ($p in $Props) {
            $val = if ($null -ne $item.$p) { [System.Web.HttpUtility]::HtmlEncode($item.$p.ToString()) } else { '' }
            $rows += "<td>$val</td>"
        }
        $rows += '</tr>'
    }
    $rows
}

# Login time bar widths
$totalLoginEstimateMs = ($LoginData.BootMs + $LoginData.GpMs + $LoginData.ProfileMs)
if ($totalLoginEstimateMs -lt 1) { $totalLoginEstimateMs = 1 }
$bootPct    = [Math]::Min(100, [Math]::Round(($LoginData.BootMs / $totalLoginEstimateMs) * 100))
$gpPct      = [Math]::Min(100, [Math]::Round(($LoginData.GpMs  / $totalLoginEstimateMs) * 100))
$profilePct = [Math]::Min(100, 100 - $bootPct - $gpPct)

$bootClass    = Severity-Class $LoginData.BootMs 60000 90000
$gpClass      = Severity-Class $LoginData.GpMs   15000 30000

# Recommendation rows
$recHtml = ''
foreach ($r in $Recommendations) {
    $icon = switch ($r.Level) {
        'red'    { '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#FCA5A5" stroke-width="1.5"><circle cx="8" cy="8" r="6"/><path d="M8 5v3M8 10.5v.5"/></svg>' }
        'yellow' { '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#FBBF24" stroke-width="1.5"><path d="M8 2L14.9 14H1.1z"/><path d="M8 7v3M8 11.5v.5"/></svg>' }
        default  { '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5"><circle cx="8" cy="8" r="6"/><path d="M5.5 8l1.5 1.5 3-3"/></svg>' }
    }
    $bg    = switch ($r.Level) { 'red' { 'rgba(220,38,38,.08)' } 'yellow' { 'rgba(245,158,11,.08)' } default { 'rgba(52,211,153,.08)' } }
    $bd    = switch ($r.Level) { 'red' { 'rgba(220,38,38,.25)' } 'yellow' { 'rgba(245,158,11,.25)' } default { 'rgba(52,211,153,.25)' } }
    $recHtml += "<div style='display:flex;gap:.75rem;align-items:flex-start;padding:1rem;background:$bg;border:1px solid $bd;border-radius:4px;margin-bottom:.5rem'>$icon <span style='font-size:.9rem;line-height:1.6'>$($r.Text)</span></div>"
}

# Source summary table
$srcHtml = ''
$sortedSrc = $EventData.SourceSummary.GetEnumerator() | Sort-Object Value -Descending | Select-Object -First 10
foreach ($s in $sortedSrc) {
    $cnt = $s.Value
    $cls = if ($cnt -ge 10) { 'color:#FCA5A5' } elseif ($cnt -ge 5) { 'color:#FBBF24' } else { 'color:#34D399' }
    $srcHtml += "<tr><td>$([System.Web.HttpUtility]::HtmlEncode($s.Key))</td><td style='$cls;font-weight:600'>$cnt</td></tr>"
}

# Network rows
$netDnsHtml = ''
foreach ($d in $NetData.DnsTimes) {
    $cls = if (-not $d.Success) { 'color:#FCA5A5' } elseif ($d.ResolvedMs -gt 500) { 'color:#FBBF24' } else { 'color:#34D399' }
    $status = if ($d.Success) { "OK ($($d.ResolvedMs) ms)" } else { "FAILED" }
    $netDnsHtml += "<tr><td>$([System.Web.HttpUtility]::HtmlEncode($d.Target))</td><td style='$cls;font-weight:600'>$status</td></tr>"
}

$netDcHtml = ''
foreach ($dc in $NetData.DcResults) {
    $cls    = if (-not $dc.Online) { 'color:#FCA5A5' } elseif ($dc.PingMs -gt 10) { 'color:#FBBF24' } else { 'color:#34D399' }
    $status = if ($dc.Online) { "$($dc.PingMs) ms" } else { "UNREACHABLE" }
    $netDcHtml += "<tr><td>$([System.Web.HttpUtility]::HtmlEncode($dc.Address))</td><td style='$cls;font-weight:600'>$status</td></tr>"
}

$ldapHtml = ''
foreach ($p in $NetData.LdapPorts) {
    $cls    = if ($p.Open) { 'color:#34D399' } else { 'color:#FCA5A5' }
    $status = if ($p.Open) { "OPEN" } else { "BLOCKED" }
    $ldapHtml += "<tr><td>$($p.Label)</td><td style='$cls;font-weight:600'>$status</td></tr>"
}

$gwHtml = if ($NetData.GatewayPing) {
    $gw  = $NetData.GatewayPing
    $cls = if ($gw.AvgMs -gt 10) { 'color:#FBBF24' } else { 'color:#34D399' }
    "<tr><td>Gateway ($([System.Web.HttpUtility]::HtmlEncode($gw.Gateway)))</td><td style='$cls;font-weight:600'>$([Math]::Round($gw.AvgMs)) ms ($($gw.Received)/$($gw.Sent) replies)</td></tr>"
} else { '<tr><td colspan="2" style="color:rgba(255,255,255,.4)">No gateway detected</td></tr>' }

# Slow GP extensions rows
$slowGpHtml = ''
foreach ($gpe in $GpData.SlowGpos) {
    $cls  = if ($gpe.MaxMs -ge 5000) { 'color:#FCA5A5' } elseif ($gpe.MaxMs -ge 2000) { 'color:#FBBF24' } else { 'color:#34D399' }
    $flag = if ($gpe.MaxMs -ge 5000) { ' <strong style="color:#FCA5A5">[SLOW]</strong>' } else { '' }
    $slowGpHtml += "<tr><td>$([System.Web.HttpUtility]::HtmlEncode($gpe.Extension))$flag</td><td style='$cls;font-weight:600'>$(Format-Ms $gpe.MaxMs)</td></tr>"
}
if (-not $slowGpHtml) { $slowGpHtml = '<tr><td colspan="2" style="color:rgba(255,255,255,.4)">No GP extension timing data found</td></tr>' }

# SCCM/Intune
$sccmStatus  = if ($MgmtData.SccmInstalled) { "<span style='color:#34D399;font-weight:600'>Installed</span> (v$($MgmtData.SccmVersion))" } else { "<span style='color:rgba(255,255,255,.5)'>Not detected</span>" }
$intuneStatus = if ($MgmtData.IntuneEnrolled) { "<span style='color:#34D399;font-weight:600'>Enrolled</span> $($MgmtData.IntuneDetails)" } else { "<span style='color:rgba(255,255,255,.5)'>Not enrolled</span>" }
$aadStatus   = if ($MgmtData.AadJoined) { "<span style='color:#34D399;font-weight:600'>Azure AD Joined</span>" } else { "<span style='color:rgba(255,255,255,.5)'>Not Azure AD joined</span>" }
$domStatus   = if ($MgmtData.DomainJoined) { "<span style='color:#34D399;font-weight:600'>Domain Joined</span>" } else { "<span style='color:rgba(255,255,255,.5)'>Not domain joined</span>" }

# System info quick-view cells
$diskCls = if ($SysInfo.DiskFreePct -lt 15) { 'color:#FCA5A5' } elseif ($SysInfo.DiskFreePct -lt 25) { 'color:#FBBF24' } else { 'color:#34D399' }

# ─── Assemble HTML ─────────────────────────────────────────────────────────────

$html = @"
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>BTG Login Diagnostic Report — $ReportDate</title>
<style>
*,*::before,*::after{margin:0;padding:0;box-sizing:border-box}
body{font-family:'Segoe UI',system-ui,sans-serif;background:#0a0a0a;color:#fff;line-height:1.6;-webkit-font-smoothing:antialiased;font-size:14px}
a{color:#34D399;text-decoration:none}a:hover{text-decoration:underline}
.report-header{background:#000;border-bottom:2px solid #0B6E4F;padding:1.5rem 2rem;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:1rem}
.brand{display:flex;align-items:center;gap:.6rem;font-size:1.1rem;font-weight:700;color:#fff}
.brand-m{width:32px;height:32px;background:linear-gradient(135deg,#0B6E4F,#1B4965);border-radius:4px;display:flex;align-items:center;justify-content:center;color:#fff;font-weight:700;font-size:.8rem;flex-shrink:0}
.brand-g{color:#34D399}
.report-meta{text-align:right;font-size:.8rem;color:rgba(255,255,255,.5)}
.report-meta strong{color:rgba(255,255,255,.8)}
.container{max-width:1200px;margin:0 auto;padding:2rem}
.section{background:#111;border:1px solid rgba(255,255,255,.06);border-radius:4px;margin-bottom:1.5rem;overflow:hidden}
.section-header{padding:1rem 1.5rem;border-bottom:1px solid rgba(255,255,255,.06);display:flex;align-items:center;gap:.75rem}
.section-icon{width:32px;height:32px;background:rgba(11,110,79,.12);border-radius:4px;display:flex;align-items:center;justify-content:center;flex-shrink:0}
.section-title{font-size:1rem;font-weight:700;color:#fff}
.section-body{padding:1.5rem}
.grid-2{display:grid;grid-template-columns:1fr 1fr;gap:1.5rem}
.grid-3{display:grid;grid-template-columns:1fr 1fr 1fr;gap:1rem}
@media(max-width:768px){.grid-2,.grid-3{grid-template-columns:1fr}.report-header{flex-direction:column}.report-meta{text-align:left}}
.kpi-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:1rem;margin-bottom:1.5rem}
.kpi{background:#0d0d0d;border:1px solid rgba(255,255,255,.06);border-radius:4px;padding:1.25rem;text-align:center}
.kpi-val{font-size:1.75rem;font-weight:700;line-height:1;margin-bottom:.25rem}
.kpi-label{font-size:.75rem;color:rgba(255,255,255,.5);text-transform:uppercase;letter-spacing:.05em}
.bar-row{margin-bottom:1rem}
.bar-label{display:flex;justify-content:space-between;font-size:.82rem;margin-bottom:.35rem;color:rgba(255,255,255,.7)}
.bar-track{height:10px;background:rgba(255,255,255,.06);border-radius:5px;overflow:hidden}
.bar-fill{height:100%;border-radius:5px;transition:width .6s ease}
.bar-fill.boot{background:linear-gradient(90deg,#0B6E4F,#34D399)}
.bar-fill.gp{background:linear-gradient(90deg,#1B4965,#60A5FA)}
.bar-fill.profile{background:linear-gradient(90deg,#7C3AED,#A78BFA)}
table{width:100%;border-collapse:collapse;font-size:.85rem}
thead th{padding:.6rem 1rem;text-align:left;font-size:.72rem;font-weight:700;text-transform:uppercase;letter-spacing:.06em;color:rgba(255,255,255,.45);border-bottom:1px solid rgba(255,255,255,.06)}
tbody td{padding:.6rem 1rem;border-bottom:1px solid rgba(255,255,255,.04);color:rgba(255,255,255,.8);word-break:break-word}
tbody tr:last-child td{border-bottom:none}
tbody tr:hover{background:rgba(255,255,255,.02)}
.sev-red{color:#FCA5A5}
.sev-yellow{color:#FBBF24}
.sev-green{color:#34D399}
.badge{display:inline-block;padding:.2rem .6rem;border-radius:3px;font-size:.72rem;font-weight:600}
.badge-green{background:rgba(52,211,153,.12);color:#34D399}
.badge-red{background:rgba(220,38,38,.12);color:#FCA5A5}
.cta-box{background:linear-gradient(135deg,rgba(11,110,79,.12),rgba(27,73,101,.08));border:1px solid rgba(11,110,79,.2);border-radius:4px;padding:2rem;text-align:center;margin-top:1.5rem}
.cta-box h3{font-size:1.2rem;font-weight:700;margin-bottom:.5rem}
.cta-box p{color:rgba(255,255,255,.6);margin-bottom:1.25rem;font-size:.9rem}
.cta-btn{display:inline-block;padding:.75rem 2rem;background:#0B6E4F;color:#fff;font-weight:600;border-radius:4px;font-size:.95rem;transition:background .2s}
.cta-btn:hover{background:#34D399;color:#000;text-decoration:none}
.footnote{margin-top:2rem;padding-top:1rem;border-top:1px solid rgba(255,255,255,.06);font-size:.75rem;color:rgba(255,255,255,.35);text-align:center}
@media print{
  body{background:#fff;color:#000}
  .section{background:#fff;border:1px solid #ddd;break-inside:avoid}
  .section-header{background:#f5f5f5}
  .section-title{color:#000}
  .kpi{background:#f9f9f9;border:1px solid #ddd}
  .cta-box{background:#f0fdf4;border-color:#86efac}
  .cta-btn{background:#0B6E4F}
  a{color:#0B6E4F}
  .sev-red{color:#dc2626}.sev-yellow{color:#d97706}.sev-green{color:#059669}
  tbody td{color:#333}
  .bar-track{background:#e5e7eb}
}
</style>
</head>
<body>

<div class="report-header">
  <div class="brand">
    <div class="brand-m">BG</div>
    Bluetech<span class="brand-g">Green</span>
    <span style="font-size:.8rem;font-weight:400;color:rgba(255,255,255,.5);margin-left:.5rem">Login Diagnostic Report</span>
  </div>
  <div class="report-meta">
    <div><strong>Report Generated:</strong> $ReportDate</div>
    <div><strong>Hostname:</strong> $env:COMPUTERNAME &nbsp;|&nbsp; <strong>User:</strong> $env:USERNAME</div>
    <div><strong>Script Runtime:</strong> ${RunDuration}s &nbsp;|&nbsp; <a href="https://bluetechgreen.com" target="_blank">bluetechgreen.com</a></div>
  </div>
</div>

<div class="container">

<!-- KPI Summary -->
<div class="kpi-grid">
  <div class="kpi">
    <div class="kpi-val $(Severity-Class $LoginData.BootMs 60000 90000)">$(Format-Ms $LoginData.BootMs)</div>
    <div class="kpi-label">Avg Boot Time</div>
  </div>
  <div class="kpi">
    <div class="kpi-val $(Severity-Class $LoginData.GpMs 15000 30000)">$(Format-Ms $LoginData.GpMs)</div>
    <div class="kpi-label">GP Processing</div>
  </div>
  <div class="kpi">
    <div class="kpi-val">$($SysInfo.RamTotalGb) GB</div>
    <div class="kpi-label">Total RAM</div>
  </div>
  <div class="kpi">
    <div class="kpi-val $diskCls">$($SysInfo.DiskFreePct)%</div>
    <div class="kpi-label">C: Free Space</div>
  </div>
  <div class="kpi">
    <div class="kpi-val">$($SysInfo.UptimeDays)d</div>
    <div class="kpi-label">System Uptime</div>
  </div>
  <div class="kpi">
    <div class="kpi-val $(if(($EventData.SysErrors.Count + $EventData.AppErrors.Count) -gt 20){'sev-red'}elseif(($EventData.SysErrors.Count + $EventData.AppErrors.Count) -gt 5){'sev-yellow'}else{'sev-green'})">$(($EventData.SysErrors.Count + $EventData.AppErrors.Count))</div>
    <div class="kpi-label">Errors Found</div>
  </div>
</div>

<!-- Recommendations -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><circle cx="8" cy="8" r="6.5"/><path d="M8 5v3M8 10.5v.5"/></svg></div>
    <div class="section-title">Recommendations ($($Recommendations.Count))</div>
  </div>
  <div class="section-body">$recHtml</div>
</div>

<!-- Login Time Breakdown -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><circle cx="8" cy="8" r="6"/><path d="M8 4.5V8l2.5 1.5"/></svg></div>
    <div class="section-title">Login Time Breakdown</div>
  </div>
  <div class="section-body">
    <div class="bar-row">
      <div class="bar-label"><span>Boot / OS Load</span><span class="$bootClass">$(Format-Ms $LoginData.BootMs) (est. avg)</span></div>
      <div class="bar-track"><div class="bar-fill boot" style="width:${bootPct}%"></div></div>
    </div>
    <div class="bar-row">
      <div class="bar-label"><span>Group Policy Processing</span><span class="$gpClass">$(Format-Ms $LoginData.GpMs) (est. avg)</span></div>
      <div class="bar-track"><div class="bar-fill gp" style="width:${gpPct}%"></div></div>
    </div>
    <div class="bar-row">
      <div class="bar-label"><span>Profile Load + Shell Init</span><span>Estimated</span></div>
      <div class="bar-track"><div class="bar-fill profile" style="width:${profilePct}%"></div></div>
    </div>
    <p style="font-size:.78rem;color:rgba(255,255,255,.35);margin-top:.75rem">Boot time sourced from Diagnostics-Performance Event ID 100. GP from GroupPolicy/Operational. Profile timing is estimated.</p>
    <h4 style="margin-top:1.5rem;margin-bottom:.75rem;font-size:.9rem">Recent Boot Events</h4>
    <table>
      <thead><tr><th>Date/Time</th><th>Boot (ms)</th><th>Main Path (ms)</th></tr></thead>
      <tbody>$(Html-TableRows ($LoginData.BootEvents | Select-Object -First 5) @('Time','BootMs','MainMs'))</tbody>
    </table>
  </div>
</div>

<!-- Group Policy Analysis -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><rect x="2" y="1" width="12" height="14" rx="1"/><path d="M5 5h6M5 8h6M5 11h4"/></svg></div>
    <div class="section-title">Group Policy Analysis</div>
  </div>
  <div class="section-body">
    <div class="grid-2">
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">Top 10 Slowest GP Extensions</h4>
        <table>
          <thead><tr><th>Extension</th><th>Max Time</th></tr></thead>
          <tbody>$slowGpHtml</tbody>
        </table>
      </div>
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">Applied GPOs (RSoP)</h4>
        <table>
          <thead><tr><th>GPO Name</th><th>Enabled</th></tr></thead>
          <tbody>$(if($GpData.AppliedGpos.Count -gt 0){Html-TableRows ($GpData.AppliedGpos | Select-Object -First 15) @('Name','Enabled')}else{'<tr><td colspan="2" style="color:rgba(255,255,255,.4)">RSoP query returned no results (may require domain admin)</td></tr>'})</tbody>
        </table>
      </div>
    </div>
  </div>
</div>

<!-- Network Diagnostics -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><circle cx="8" cy="8" r="6"/><path d="M2 8h12M8 2a10 10 0 010 12M8 2a10 10 0 000 12"/></svg></div>
    <div class="section-title">Network Diagnostics</div>
  </div>
  <div class="section-body">
    <div class="grid-3">
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">DNS Resolution</h4>
        <table><thead><tr><th>Target</th><th>Result</th></tr></thead><tbody>$netDnsHtml</tbody></table>
      </div>
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">Gateway Ping</h4>
        <table><thead><tr><th>Host</th><th>Latency</th></tr></thead><tbody>$gwHtml</tbody></table>
        <h4 style="margin-top:1.25rem;margin-bottom:.75rem;font-size:.9rem">Domain Controllers</h4>
        <table><thead><tr><th>Address</th><th>Ping</th></tr></thead><tbody>$(if($netDcHtml){$netDcHtml}else{'<tr><td colspan="2" style="color:rgba(255,255,255,.4)">Not domain-joined</td></tr>'})</tbody></table>
      </div>
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">LDAP Ports</h4>
        <table><thead><tr><th>Port</th><th>Status</th></tr></thead><tbody>$(if($ldapHtml){$ldapHtml}else{'<tr><td colspan="2" style="color:rgba(255,255,255,.4)">No DC detected to check</td></tr>'})</tbody></table>
      </div>
    </div>
  </div>
</div>

<!-- Event Log Summary -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><path d="M3 1h10v14H3z"/><path d="M6 5h4M6 8h4M6 11h2"/></svg></div>
    <div class="section-title">Event Log Analysis</div>
  </div>
  <div class="section-body">
    <div class="grid-2">
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">Top Error Sources (System + Application)</h4>
        <table>
          <thead><tr><th>Source</th><th>Error Count</th></tr></thead>
          <tbody>$(if($srcHtml){$srcHtml}else{'<tr><td colspan="2" style="color:rgba(255,255,255,.4)">No errors found</td></tr>'})</tbody>
        </table>
      </div>
      <div>
        <h4 style="margin-bottom:.75rem;font-size:.9rem">Recent System Errors (last 50)</h4>
        <table>
          <thead><tr><th>Time</th><th>Source</th><th>ID</th></tr></thead>
          <tbody>$(Html-TableRows ($EventData.SysErrors | Select-Object -First 10) @('Time','Source','Id'))</tbody>
        </table>
      </div>
    </div>
    <h4 style="margin-top:1.5rem;margin-bottom:.75rem;font-size:.9rem">Recent Application Errors (last 50)</h4>
    <table>
      <thead><tr><th>Time</th><th>Source</th><th>ID</th><th>Message (truncated)</th></tr></thead>
      <tbody>$(Html-TableRows ($EventData.AppErrors | Select-Object -First 10) @('Time','Source','Id','Message'))</tbody>
    </table>
  </div>
</div>

<!-- System Info -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><rect x="1" y="3" width="14" height="10" rx="1"/><path d="M5 13v2M11 13v2M3 15h10"/></svg></div>
    <div class="section-title">System Information</div>
  </div>
  <div class="section-body">
    <div class="grid-2">
      <table>
        <tbody>
          <tr><td style="color:rgba(255,255,255,.5);width:45%">OS</td><td>$($SysInfo.OsName)</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">Build</td><td>$($SysInfo.OsBuild) ($($SysInfo.OsVersion))</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">Architecture</td><td>$($SysInfo.Architecture)</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">Last Boot</td><td>$($SysInfo.LastBoot)</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">Uptime</td><td>$($SysInfo.UptimeDays) days</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">Startup Programs</td><td>$($SysInfo.StartupCount)</td></tr>
        </tbody>
      </table>
      <table>
        <tbody>
          <tr><td style="color:rgba(255,255,255,.5);width:45%">CPU</td><td>$($SysInfo.CpuName)</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">CPU Cores</td><td>$($SysInfo.CpuCores)</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">CPU Load</td><td>$($SysInfo.CpuLoad)%</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">RAM</td><td>$($SysInfo.RamTotalGb) GB</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">C: Total</td><td>$($SysInfo.DiskTotalGb) GB</td></tr>
          <tr><td style="color:rgba(255,255,255,.5)">C: Free</td><td class="$diskCls">$($SysInfo.DiskFreeGb) GB ($($SysInfo.DiskFreePct)%)</td></tr>
        </tbody>
      </table>
    </div>
  </div>
</div>

<!-- SCCM / Intune -->
<div class="section">
  <div class="section-header">
    <div class="section-icon"><svg width="16" height="16" viewBox="0 0 16 16" fill="none" stroke="#34D399" stroke-width="1.5" stroke-linecap="round"><path d="M8 1l6 3v4c0 3.5-2.5 6.5-6 8-3.5-1.5-6-4.5-6-8V4l6-3z"/><path d="M5.5 8l1.5 1.5 3-3"/></svg></div>
    <div class="section-title">Endpoint Management Detection</div>
  </div>
  <div class="section-body">
    <table>
      <tbody>
        <tr><td style="color:rgba(255,255,255,.5);width:30%">SCCM / ConfigMgr</td><td>$sccmStatus</td></tr>
        <tr><td style="color:rgba(255,255,255,.5)">Intune / MDM</td><td>$intuneStatus</td></tr>
        <tr><td style="color:rgba(255,255,255,.5)">Azure AD Join</td><td>$aadStatus</td></tr>
        <tr><td style="color:rgba(255,255,255,.5)">Domain Join</td><td>$domStatus</td></tr>
      </tbody>
    </table>
  </div>
</div>

<!-- CTA -->
<div class="cta-box">
  <h3>Need Help Fixing Slow Logins?</h3>
  <p>This report is a starting point. Our team has optimized login performance for hundreds of organizations — from GP rationalization to Intune tuning and network remediation.</p>
  <a href="https://bluetechgreen.com/contact.html" class="cta-btn" target="_blank">Get a Free Consultation</a>
  <p style="margin-top:.75rem;font-size:.75rem;color:rgba(255,255,255,.4)">Powered by <a href="https://bluetechgreen.com" target="_blank">BluetechGreen LLC</a> &mdash; Enterprise IT Solutions</p>
</div>

<div class="footnote">
  BTG-LoginDiag v1.0 &nbsp;&bull;&nbsp; Generated on $env:COMPUTERNAME &nbsp;&bull;&nbsp; $ReportDate &nbsp;&bull;&nbsp; Script runtime: ${RunDuration}s &nbsp;&bull;&nbsp;
  <a href="https://bluetechgreen.com/tools/login-diagnostics.html" target="_blank">bluetechgreen.com/tools</a>
</div>

</div>
</body>
</html>
"@

# ─── Write Report ─────────────────────────────────────────────────────────────

$html | Out-File -FilePath $ReportFile -Encoding UTF8 -Force

Write-Host ""
Write-Host "  ============================================" -ForegroundColor Green
Write-Host "   BTG Login Diagnostic Report Complete" -ForegroundColor Green
Write-Host "  ============================================" -ForegroundColor Green
Write-Host "   Report: $ReportFile" -ForegroundColor Cyan
Write-Host "   Runtime: ${RunDuration}s" -ForegroundColor Cyan
Write-Host ""

# Open report in default browser
try {
    Start-Process $ReportFile
} catch {
    Write-Host "  Could not auto-open report. Please open manually:" -ForegroundColor Yellow
    Write-Host "  $ReportFile" -ForegroundColor White
}