Skip to content
PS Script
5/6 checks passed

Intune Make Enrollment User Admin

This Intune-deployable script elevates the enrollment user to a local administrator on Windows devices. Packaged as an .INTUNEWIN app, it is deployed through Microsoft Intune to targeted users with install and uninstall commands to grant or revoke admin rights after enrollment. It uses a requirements check for detection and can be reconfigured later, providing an Autopilot-like capability fully managed by Intune.

Works with
WindowsWin32 Apps
View on GitHub

Screenshots

1 / 3

Swipe to see more

Security Analysis

5of 6
1 Issue Found

3 files scanned on Jul 12, 2026

Issues Detected
No Malicious Patterns
No known malware techniques
Elevates the current user to local Administrators by adding the user SID to the Administrators group (Add-LocalGroupMember). This is a direct privilege escalation risk. The script also uses Start-Transcript for logging and supports uninstall via Remove-LocalGroupMember. While it aligns with intended admin tooling, it creates significant risk if misused or executed without proper approvals.
Passed Checks
No Obfuscated Code
No Remote Execution
No Credential Theft
No Data Exfiltration
No Hardcoded Secrets
AI Analysis

The codebase implements enrollment-related admin tooling with privilege elevation (adding the current user to the local Administrators group) and privilege-discovery behavior (checking admin membership). There are no obfuscated/encoded payloads, no remote script downloads, no credential harvesting, and no explicit data exfiltration observed. The primary security concern is legitimate but high-risk privilege elevation and privilege enumeration capabilities. Recommend enforcing strict access controls, approval workflows in Intune, auditing of such actions, and prefer Graph/Intune management APIs over local group modifications where possible to minimize risk.

You might also like

PS Script

IntuneStatefulDeviceFingerprinting

KuShu-Shimon Intune Stateful Device Fingerprinting (ISDF) provides a tamper-resistant device fingerprint for enrolled Windows devices, enforced via Intune Custom Compliance and DPAPI-encrypted baselines. In Cloud mode it attests fingerprints to Entra ID through APIM and a Logic App to enable trusted device filters, dynamic groups, and stronger Conditional Access policies. The solution collects on-device signals, stores encrypted baselines, self-heals missing keys, and reports ISDF booleans for compliant state.

Graham HildGraham Hild
Desktop App

Run as Domain User

A wrapper app that uses ShellRunAs to launch a target executable under a defined Active Directory domain user from non-domain-joined Windows devices. It enables cloud-managed devices to run legacy on-prem tools (RSAT) by prompting for domain credentials and launching the configured app with elevated rights. It relies on simple domain.txt and app.txt configuration and is packaged for Intune with explicit install/uninstall commands and a Start Menu entry.

Niklas RastNiklas Rast
PS Script

LAPS Reader

LAPS Reader is a Windows PowerShell/WPF GUI tool that retrieves Windows LAPS passwords stored in Intune (Entra) via Microsoft Graph. It signs in to Graph, resolves a device by display name, and displays the local account, password, backup time, and account SID with a one-click copy. Intended for IT/helpdesk staff, it requires the Microsoft.Graph.Authentication module and permissions DeviceLocalCredential.Read.All and Device.Read.All.

Reshat BekteshiReshat Bekteshi
PS Script

Intune App Factory

Intune App Factory is a set of PowerShell scripts run in an Azure DevOps Pipeline that automatically detects, downloads, packages, and publishes onboarded applications as Win32 apps to Microsoft Intune, ensuring up-to-date deployments. It supports onboarding via manifests, integrates the PowerShell App Deployment Toolkit, and automates version checks from Winget, Evergreen, or Storage Account sources to streamline packaging and publishing.

Nickolaj AndersenNickolaj Andersen