DTLsaysWhat — User Guide

Overview

DTLsaysWhat is a Windows system inventory tool written in Python. Inspired by the WHAT utility developed by Stanley Rabinowitz for DEC VAX/VMS systems in the 1980s, it collects detailed information about the local or a remote Windows machine, organized into up to 20 functional categories.

Every run automatically produces two output files saved to disk: a plain-text report (.txt) and a self-contained navigable HTML report (.html) with a fixed left sidebar.

Quick Start

Install dependencies

pip install wmi pywin32 psutil

Run a full inventory

python DTLsaysWhat.py all

This collects all 20 categories sequentially and writes two files in the current directory, named after the hostname and timestamp:

DTLsaysWhat_HOSTNAME_20260528_081930.txt
DTLsaysWhat_HOSTNAME_20260528_081930.html

Run a single category

python DTLsaysWhat.py system
python DTLsaysWhat.py security
python DTLsaysWhat.py perf

Specify an output path

python DTLsaysWhat.py all --output C:\Reports\inventory.txt

The HTML file is saved alongside as inventory.html.

Command Syntax

python DTLsaysWhat.py [CATEGORY] [--output FILE] [--computer NAME_OR_IP]

All arguments are optional. Without arguments, the tool defaults to the system category and targets the local machine.

Output Files

Each run always produces two files regardless of the category selected.

Text report (.txt): UTF-8 plain text, structured with section headers and subsection separators. Suitable for archiving, diffing, or sending to a colleague.

HTML report (.html): Self-contained HTML file with a dark terminal aesthetic (green on black, monospace font). Includes a fixed left sidebar with anchor links to each section, making it easy to navigate long reports. Both files share the same base name.

Permissions

Several categories require elevated privileges (Run as Administrator). Without elevation, these sections will return partial data or nothing at all — no error is raised, the subsection output simply stays empty or shows a "not available" message.

Categories that benefit from elevation: security (BitLocker, Hyper-V, TPM, Secure Boot, Firewall), tasks, users, virt.

Categories: Output Reference

The following sections document each category with a description of the data collected and a representative extract from a real run on a Windows 11 machine (Acer Predator PO3-600, i7-8700, 16 GB RAM).

Remote Collection

Use --computer to target a remote Windows machine:

python DTLsaysWhat.py hardware --computer 192.168.1.42
python DTLsaysWhat.py all --computer WORKSTATION01

Remote collection relies on WMI over the network and requires appropriate permissions on the target machine. The following categories always run locally regardless of --computer: security, users, tasks, software (AppX packages), events, virt.

Encoding

On French Windows systems, cmd.exe defaults to OEM code page 850. The tool detects and handles this automatically. To guarantee correct display of accented characters, either:

• invoke the script with python -X utf8 DTLsaysWhat.py, or
• set the environment variable PYTHONUTF8=1 before running.

Known Limitations

• Windows only. The tool imports wmi, winreg, and calls Windows-specific APIs. It will not run on Linux or macOS.
• Remote collection scope. --computer does not extend to PowerShell-based subsections (security, users, tasks, AppX software, events, virt), which always query the local machine.
• Elevation required. Running without administrator privileges produces no errors for restricted sections; their output will simply be empty or show a "not available" message.
• perf is a snapshot. CPU percentages are sampled over a 1-second interval per call. There is no continuous monitoring mode.
• events has no date filter. The section retrieves the 20 most recent errors and warnings regardless of age. The "last 24 hours" label in the section header reflects intent only, not an applied filter.
• Memory type. DDR generation may show as "Unknown" for some DIMM configurations due to a WMI reporting limitation.
• VRAM reporting. Some NVIDIA configurations cause Win32_VideoController to return a negative VRAM value. This is a WMI quirk, not a tool defect.