Loading
PS Script
5/6 checks passed
Updated Jan 2026IntuneStatefulDeviceFingerprinting
KuShu-Shimon Intune Stateful Device Fingerprinting (ISDF) provides a tamper-resistant device fingerprint for enrolled Windows devices, enforced via Intune Custom Compliance and DPAPI-encrypted baselines. In Cloud mode it attests fingerprints to Entra ID through APIM and a Logic App to enable trusted device filters, dynamic groups, and stronger Conditional Access policies. The solution collects on-device signals, stores encrypted baselines, self-heals missing keys, and reports ISDF booleans for compliant state.
Works with
WindowsEntra IDComplianceConditional Access
Security Analysis
5of 6
1 Issue Found
3 files scanned on Sep 20, 2026
Issues Detected
No Obfuscated Code
No base64 encoded commands or hidden scripts
Inline PowerShell payload is encoded with Base64 via -EncodedCommand for the scheduled task. This obfuscation conceals behavior and can hinder auditing and review. It also enables automated persistence-like execution on multiple triggers.
Passed Checks
No Remote Execution
No Credential Theft
No Data Exfiltration
No Malicious Patterns
No Hardcoded Secrets
AI Analysis
The codebase includes legitimate Intune/Azure discovery and telemetry components but exhibits notable security-relevant patterns: encoded/obfuscated inline commands in watchdog for persistence, a SYSTEM-level scheduled task for ongoing execution, and cloud-based telemetry exfiltration via webhooks. There are no hardcoded secrets. Recommend auditing the use of encoded commands, tightening registry and scheduled task access, validating webhook trust, and ensuring that telemetry is scoped to necessary data with explicit user/organizational consent.
You might also like
PS Script
Niklas Rast
Intune Make Enrollment User Admin
This Intune-deployable script elevates the enrollment user to a local administrator on Windows devices. Packaged as an .INTUNEWIN app, it is deployed through Microsoft Intune to targeted users with install and uninstall commands to grant or revoke admin rights after enrollment. It uses a requirements check for detection and can be reconfigured later, providing an Autopilot-like capability fully managed by Intune.
Niklas RastDesktop AppNiklas Rast
Run as Domain User
A wrapper app that uses ShellRunAs to launch a target executable under a defined Active Directory domain user from non-domain-joined Windows devices. It enables cloud-managed devices to run legacy on-prem tools (RSAT) by prompting for domain credentials and launching the configured app with elevated rights. It relies on simple domain.txt and app.txt configuration and is packaged for Intune with explicit install/uninstall commands and a Start Menu entry.
Niklas RastPS Script
Reshat Bekteshi
LAPS Reader
LAPS Reader is a Windows PowerShell/WPF GUI tool that retrieves Windows LAPS passwords stored in Intune (Entra) via Microsoft Graph. It signs in to Graph, resolves a device by display name, and displays the local account, password, backup time, and account SID with a one-click copy. Intended for IT/helpdesk staff, it requires the Microsoft.Graph.Authentication module and permissions DeviceLocalCredential.Read.All and Device.Read.All.
Reshat BekteshiOther
Cody Keats
Mace
M.A.C.E. is a native macOS app that lets security teams build, customize, audit, and deploy macOS compliance baselines using the mSCP 2.0 framework without scripting. It offers a visual, three-panel editor with 500+ rules, real-time audit results, and exportable configuration profiles for MDMs such as Intune and Jamf. The tool prioritizes ease of use, cross-MDM readiness, and reproducible baselines.
Cody Keats