Best PowerShell Scripts for Microsoft Intune

A PowerShell diagnostic script for analyzing Windows Autopilot deployments. Provides comprehensive details about Autopilot profile settings, policies, apps, and certificate profiles tracked via Enrollment Status Page, with support for local PC analysis and captured log files.

A community-driven repository of 86+ PowerShell detection and remediation scripts for Microsoft Intune Endpoint Analytics. Includes scripts for system health, security hardening, device management, application management, optimization, and diagnostics.

A PowerShell-based customization tool packaged as an Intune Win32 app for configuring Windows 10/11 devices during Autopilot deployment. Customizes start menu layout, background/theme, time zone, removes built-in apps, installs OneDrive, configures language packs, and manages Windows features.

A PowerShell-based auditing tool for IT administrators managing Microsoft Intune. Provides comprehensive analysis of policy, app, and configuration assignments across users, groups, and devices. Features include assignment verification, policy discovery, empty group detection, HTML report generation with charts and dark/light mode, CSV export, and support for multiple authentication methods including certificate-based automation.

A PowerShell-based GUI tool for visualizing comprehensive Intune device information. Shows Azure AD group memberships, Intune filter assignments, application and configuration targeting, BitLocker recovery keys, LAPS passwords, Autopilot profiles, and remediation script status with color-coded assignment states.

A PowerShell script for analyzing Intune Management Extension logs and creating timeline reports. Tracks Win32App deployments, WinGetApp packages, PowerShell scripts, Proactive Remediations, Custom Compliance, and Autopilot ESP phases with HTML reports and integrated LogViewerUI.

A collection of PowerShell detection and remediation scripts for Microsoft Intune. Organized into categories: Device Compliance, Device Configuration, Device Performance, Microsoft Defender AV, Miscellaneous, Reporting, and Toast Notifications for proactive endpoint issue resolution.

A collection of community-tested PowerShell scripts for automating Microsoft Intune management tasks. Features device lifecycle management, compliance reporting, application deployment automation, and threat detection workflows. Scripts support both local execution and Azure Automation Runbook deployment with automatic environment detection for authentication. Uses direct Graph API access for minimal dependencies and easier troubleshooting.

Windows Update Remediation Tool is an automated WinForms utility for diagnosing and repairing Windows Update issues. It offers a selectable sequence of remediation steps—stopping services, cleaning caches, resetting permissions, re-registering DLLs, Winsock reset, restarting services, update scans, and SetupDiag diagnostics—with built-in logging. Administrators can run it elevated, monitor per-step progress, and generate logs for troubleshooting.

Intune App Factory is a set of PowerShell scripts run in an Azure DevOps Pipeline that automatically detects, downloads, packages, and publishes onboarded applications as Win32 apps to Microsoft Intune, ensuring up-to-date deployments. It supports onboarding via manifests, integrates the PowerShell App Deployment Toolkit, and automates version checks from Winget, Evergreen, or Storage Account sources to streamline packaging and publishing.

Autopilot Management is a Windows-based Intune utility that simplifies Autopilot device administration. It supports searching by serial number or device name, bulk updates to Group Tags, bulk or single deletions, and uploading hardware hashes. It can load and verify devices from CSV, backup data, and query with an optional cache for large environments. Authentication uses Azure Graph tools (MFA supported) for secure admin access.

Edge Extension Inventory Collector is a lightweight tool that scans endpoints to enumerate installed Microsoft Edge extensions, capturing extension ID, name, publisher, version, enabled state, and install source. It exports a consolidated inventory to JSON or CSV for software asset management, security audits, and Intune/Endpoint Manager workflows. It helps maintain visibility of browser extensions across managed devices and supports baseline compliance checks.

AutopilotGroupTagger is a PowerShell-based utility for bulk updating and managing Windows Autopilot Device Group Tags, with optional unblocking of devices. It supports updating tags by group, manufacturer, model, purchase order, and interactive selection, plus exporting data and creating dynamic Entra ID groups. The tool runs with Microsoft Graph authentication and supports PowerShell 7 on Windows/macOS, including a whatIf simulation mode and Community Tool status.

IntuneComplianceMaintainer is a PowerShell automation script that keeps Microsoft Intune compliance and app-protection policies up to date with the latest supported OS minimums across iOS, iPadOS, macOS, Android, and Windows. It uses endoflife.date and the Graph Windows Update Catalog to drive cadence-based updates, with flexible authentication (Managed Identity, App Registration with certificate or secret, plus Key Vault integration) and safety features like dry-run and downgrade protection. It provides comprehensive logging and built-in retry logic for resilience.

IntuneFirewallMigration is a public-preview tool that migrates Group Policy and local firewall rules into Intune as Settings Catalog policies. It supports selecting specific firewall profiles (Domain, Private, Public) and importing only inbound or outbound rules, using Microsoft.Graph.Authentication with Invoke-MgGraphRequest. The script disables telemetry, requires Graph permissions (DeviceManagementConfiguration.ReadWrite.All), and works with PowerShell 5 or 7 to modernize firewall management in Intune.

Feature Update Controller is a remediation package for Microsoft Intune that centralizes Windows feature upgrades with configurable setup, scripts, and custom actions. It generates and manages SetupConfig.ini, prestages Script Modules, and configures Custom Actions to tailor upgrade behavior, including post-install and rollback steps. The solution downloads and applies a manifest.json, stages scripts and actions, and supports updating or removing configurations on devices for a consistent upgrade experience.

A PowerShell utility for capturing, comparing, and exporting Windows Defender firewall rules for Microsoft Intune deployment. Captures baseline rules, compares post-install changes, and exports to JSON for Intune or CSV formats with interactive menu and CLI modes.

Intune Log Collector is an Azure-based solution that collects logs from Intune-managed devices, including files, directories, and event logs. It deploys a Function App, Storage Account, and Key Vault, with the Remediation script driving log collection per LogsGatherRules.json and uploading a compressed archive to the logs container. Deployments support Azure Template Spec (Bicep/ARM) or direct ARM templates, with optional UI and post-deployment steps.

Intune Remote Help Launcher is a PowerShell WPF tool for IT admins to search Intune-managed devices by name or primary user, view device details, and launch Microsoft Remote Help sessions from one interface. It supports Windows, Android, iOS, and macOS devices, displays OS, compliance, ownership, model and last sync, and can issue sync or restart commands or open the device in the Intune admin center. It uses Microsoft Graph delegated authentication (auto-installs the Graph module if needed) and requires Remote Help licensing to be configured.

KuShu-Shimon Intune Stateful Device Fingerprinting (ISDF) provides a tamper-resistant device fingerprint for enrolled Windows devices, enforced via Intune Custom Compliance and DPAPI-encrypted baselines. In Cloud mode it attests fingerprints to Entra ID through APIM and a Logic App to enable trusted device filters, dynamic groups, and stronger Conditional Access policies. The solution collects on-device signals, stores encrypted baselines, self-heals missing keys, and reports ISDF booleans for compliant state.

IntuneWin32AppUninstall is a PowerShell GUI tool that inventories MSI-based apps by scanning uninstall registry keys (HKLM and HKCU) and generates Intune-compatible detection and remediation scripts. For each selected app it creates a ready-to-deploy package with Detect and Remediate scripts, a README, and AppInfo.json, with batch generation, per-app folders, and CSV export. Remediation uninstalls silently via msiexec /X {GUID} and logs results for Intune deployment under Endpoint Security.

An Azure Automation Runbook for Microsoft Intune that automatically updates the iOS compliance policy osMinimumVersion based on real device inventory. It queries devices via Microsoft Graph, derives a safe minimum iOS version (third newest when enough data, with a fallback), updates the policy if needed, and sends a detailed HTML notification. Emphasizes idempotency, robust error handling, and routine scheduling.

PowerShell ADMX Wizard creates custom ADMX/ADML templates from a CSV of registry keys, enabling Windows policies via Intune. It generates GUID-based templates, adds registry entries (STRING, DWORD, BINARY), and logs progress. After creation, upload the ADM/ADML to Intune as Imported ADMX to apply through a configuration profile.

IntuneOSCompliance is a PowerShell tool that automatically updates Windows, Android, and Apple OS compliance policies, app protection policies, and device enrollment platform restrictions to the latest supported OS versions. It fetches current builds via APIs and RSS feeds, detects policies needing updates, and can push results to a rich Microsoft Teams card via an Incoming Webhook. Public Preview with configurable report-only mode and OS version offsets.

Windows Media Creation CLI is a PowerShell-based tool that automates building Windows installation media on a USB drive. It supports Windows 11 (22H2-25H2) and Windows 10, with customizable architecture, language, region and edition, enabling fully automated media creation. It also supports OEM driver injection via AUTOUNATTEND or DISM, single or multi-driver packs, and can generate an installwimdrivers.csv catalog to track installed drivers.

Windows Recovery Partition Editor resizes the local Windows Recovery Partition to 984MB and injects CAB files to enable optional features and language support. It deploys via a PowerShell script, placing architecture-specific CABs under tools\amd64 or tools\arm64cpu and matching language packs, with an optional backup of OEM images. Detection uses the registry key HKLM:\SOFTWARE\YourCompanyNameHere\Client-Recovery with value 1.0.0.

Apple Compliance Version Updater automatically updates the osMinimumVersion in macOS and iOS/iPadOS Intune compliance policies based on the SOFA feed. It provides per-platform control, supports flexible version strategies (track major, pin to major, or track minor), and runs in Azure Automation with Managed Identity for zero-secret maintenance. Choose separate or unified runbooks for scalable, diagnostics-driven policy updates.

This Intune-deployable script elevates the enrollment user to a local administrator on Windows devices. Packaged as an .INTUNEWIN app, it is deployed through Microsoft Intune to targeted users with install and uninstall commands to grant or revoke admin rights after enrollment. It uses a requirements check for detection and can be reconfigured later, providing an Autopilot-like capability fully managed by Intune.

A PowerShell script that enrolls devices into Windows Autopilot using Azure App Registration credentials. Works without hybrid Azure AD join or SCCM, enabling unattended deployment via RMM tools. Uses community hardware hash collection module for reliable device registration.

A PowerShell script for comprehensive analysis and reporting of Microsoft Intune environment anomalies. Identifies application failures, multi-user devices, BitLocker status, Autopilot hash issues, inactive devices, compliance violations, OS edition overview, and disabled user accounts.

LAPS Reader is a Windows PowerShell/WPF GUI tool that retrieves Windows LAPS passwords stored in Intune (Entra) via Microsoft Graph. It signs in to Graph, resolves a device by display name, and displays the local account, password, backup time, and account SID with a one-click copy. Intended for IT/helpdesk staff, it requires the Microsoft.Graph.Authentication module and permissions DeviceLocalCredential.Read.All and Device.Read.All.