A collection of PowerShell solutions and scripts for Microsoft Intune, Windows Autopilot, Entra ID, Defender, Configuration Manager, Global Secure Access, Azure, and Windows migration.
Warning
Review and test every script in a non-production environment before deployment. The repository is provided as-is.
- Last updated is the date of the most recent Git commit that changed the linked script or solution.
- Finished means the script, its README, and its changelog do not identify it as unfinished. It is not a support or production-readiness guarantee.
- Unfinished is used when the script, README, or changelog explicitly says that work is incomplete.
- Moved identifies an entry retained only as a pointer to another repository.
Multi-file solutions with dedicated documentation and supporting assets.
| Solution | Scripts | Description | Status | Last updated |
|---|---|---|---|---|
| Broken Autopilot Device Cleanup | Cleanup script | Identifies duplicate or stale Autopilot, Intune, and Entra device records and optionally cleans them up. | Unfinished | 2026-08-30 |
| Write Admins to Azure Table | Detect / Remediate / HTML export / Stress-test data | Inventories local administrators through Intune remediation, Azure Table Storage, Excel, and HTML reporting. | Finished | 2026-08-30 |
Each entry links to its detection script. The remediation script is linked separately where present.
| Remediation | Scripts | Status | Last updated |
|---|---|---|---|
| Disable domain credentials | Detect / Remediate | Finished | 2025-10-17 |
| Disable WebDAV service | Detect / Remediate | Finished | 2025-10-17 |
| Disable WPAD service | Detect / Remediate | Finished | 2025-10-17 |
| Global Secure Access settings | Detect / Remediate | Finished | 2026-08-30 |
| New Outlook device setting | Detect / Remediate | Finished | 2025-02-19 |
| New Outlook user setting | Detect / Remediate | Finished | 2025-02-19 |
| Print to PDF and XPS | Detect / Remediate | Finished | 2025-02-19 |
| SSO prompt administrator control | Detect / Remediate | Finished | 2026-08-30 |
| Reset Windows Update settings | Detect / Remediate | Finished | 2026-08-30 |
See the Intune remediation changelog for detailed changes.
| Script | Description | Status | Last updated |
|---|---|---|---|
| Add-GroupTagToAllAPDevices.ps1 | Adds a group tag to Autopilot devices. | Finished | 2024-05-22 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Invoke-BitlockerEscrowKey.ps1 | Escrows a BitLocker recovery key through Configuration Manager. | Finished | 2026-08-30 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| LDAPSigningAnalyzer.ps1 | Analyzes LDAP signing configuration and related domain controller events. | Finished | 2026-08-30 |
| NTLMAuditAnalyse.ps1 | Collects and exports NTLM audit data. | Finished | 2026-08-30 |
| Set-WindowsProductKey.ps1 | Installs and activates a Windows product key from a Defender Live Response session. | Finished | 2026-08-30 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| New-AzureADApplicationProxyApplicationCommunity.ps1 | Creates an Entra application proxy application. | Finished | 2026-01-23 |
| Create-CustomIntuneRoleUsingGraph.ps1 | Creates a custom Intune role through Microsoft Graph; retained as a reference where permissions are unsupported. | Finished | 2026-08-30 |
| Create-RandomUsersUsingGraph.ps1 | Creates random test users through Microsoft Graph batch requests. | Finished | 2025-08-29 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Get-GSAPolicyRuleIDandName.ps1 | Lists Global Secure Access policy rule IDs and names. | Finished | 2025-08-29 |
| Script-ShowSignOutAndDisablePrivateAccessButton.ps1 | Configures Global Secure Access client sign-out and Private Access controls. | Finished | 2024-10-01 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Analyze-CSP-Header.ps1 / Demo report | Analyzes Content-Security-Policy response headers and creates a self-contained interactive HTML report. | Finished | 2026-09-01 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Autopatch-FindFUEnrollingDevices.ps1 | Finds Autopatch devices stuck in feature update enrollment. | Unfinished | 2025-07-02 |
| Compliance_SentinelOne.ps1 and JSON | Reports SentinelOne state for Intune custom compliance. | Finished | 2025-08-05 |
| Detection-Script with Wait.ps1 | Provides a detection-script template with retry and wait behavior. | Finished | 2026-01-23 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| AutopilotDualDeviceFinder.ps1 | Finds and remediates duplicate Autopilot device records. | Unfinished | 2025-10-17 |
| Connect-SettingsCatalog-To-Group.ps1 | Assigns Settings Catalog policies to a group. | Finished | 2025-07-02 |
| Convert-PolicySet.ps1 | Converts an Intune policy set. | Unfinished | 2025-07-02 |
| Disable-AllowComputerToTurnOffDeviceForNIC.ps1 | Disables the NIC power-management option that lets Windows turn off the device. | Finished | 2026-05-01 |
| Find-WindowsUpdateNotifications.ps1 | Correlates Windows Update notification and installation events. | Unfinished | 2026-08-30 |
| Get-OutlookAddInsToWMI.ps1 | Inventories Outlook add-ins across user profiles into WMI. | Finished | 2026-05-01 |
| List-EAMApplications.ps1 | Lists Enterprise App Management applications. | Finished | 2025-07-02 |
| Rename-ComputerRandomizer.ps1 | Renames a computer using a randomized name. | Unfinished | 2025-07-02 |
| ScriptWrapper.ps1 | Wraps script execution with shared logging and process behavior. | Finished | 2025-07-02 |
| Send-EntraDeviceIDToWebhookDuringESP.ps1 | Sends the Entra device ID to a webhook during Enrollment Status Page provisioning. | Finished | 2026-08-30 |
| Win32App-Wait.ps1 | Waits for a condition during Win32 app deployment. | Finished | 2025-07-02 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Set-BackgroundWallpaperAsUser.ps1 | Sets the desktop background in the user context. | Finished | 2025-08-05 |
| Set-DisableClipSVCSubscription.ps1 | Configures the ClipSVC subscription setting. | Finished | 2026-08-30 |
| Set-TimeZoneUsingAzureMaps.ps1 | Sets the device time zone using location data and Azure Maps. | Finished | 2025-08-29 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Add-EntraDeviceToGroupFromWebhook.ps1 | Adds an Entra device to a group from a webhook request. | Finished | 2026-08-30 |
| Add-ExcludeTagToEntraDeviceFromGroup.ps1 | Adds an exclusion extension attribute to devices in a group. | Finished | 2025-12-11 |
| Add-InfoToEntraDeviceExtensions.ps1 | Writes primary-user and Intune information to Entra device extension attributes. | Finished | 2025-12-11 |
| BrokenAutopilotDeviceCleanup-Runbook.ps1 | Runs analysis or cleanup of stale Autopilot-related device records in Azure Automation. | Finished | 2026-08-30 |
| Delete-DevicesOlderThanDays.ps1 | Deletes devices older than a configured age. | Finished | 2026-05-01 |
| Repair-PrimaryUser.ps1 | Repairs Intune primary-user assignments. | Unfinished | 2026-08-30 |
Additional setup guidance is available in the runbook README.
| Script | Description | Status | Last updated |
|---|---|---|---|
| Search-IntuneSetting.ps1 | Provides a Windows UI for searching exported Intune settings. | Unfinished | 2026-03-20 |
| Script | Description | Status | Last updated |
|---|---|---|---|
| Windows11BasicInformationCollection.ps1 | Collects basic Windows 11 migration readiness information. | Finished | 2024-12-05 |
| Project | Current location | Status | Last updated here |
|---|---|---|---|
| Intune Network Requirements | Repository pointer | Moved | 2025-08-30 |
| Azure Network Requirements | Repository pointer | Moved | 2025-02-14 |
See the repository changelog and the changelog in each category for detailed changes.