From 6949ee947df91b6ef0d4858a0689a736898f212e Mon Sep 17 00:00:00 2001 From: John Gage Faulkner <46038619+johngagefaulkner@users.noreply.github.com> Date: Sat, 18 Jul 2026 22:35:46 -0400 Subject: [PATCH 1/5] Add README with Intune script samples and guidelines Added a comprehensive README file detailing PowerShell script samples for Microsoft Intune and endpoint management scenarios, including usage examples, prerequisites, and contribution guidelines. --- README.md | 113 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 113 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..c988310 --- /dev/null +++ b/README.md @@ -0,0 +1,113 @@ +# Intune Script Samples + +PowerShell script samples for common Microsoft Intune and endpoint management scenarios. + +This repository contains practical scripts you can use for: + +- Intune proactive remediation detection logic +- Local endpoint configuration changes (services/registry) +- Intune connectivity validation from client devices +- Microsoft Graph reporting for Intune app assignments +- Forcing an MDM sync on Windows devices + +Repository: https://github.com/jbasuroy369/Intune-Script-Samples + +--- + +## Scripts included + +| Script | Purpose | Typical Intune Use | +|---|---|---| +| `Detect - MultipleIntuneMDMCert.ps1` | Detects if more than one **Microsoft Intune MDM Device CA** certificate exists in `LocalMachine\My`. Exits `1` if remediation is needed. | Proactive Remediations (Detection script) | +| `Detect-OfficeUpdateChannel.ps1` | Detects Office Click-to-Run channel/version against Microsoft Office releases endpoint and validates Semi-Annual + latest version logic. | Compliance check / detection workflow | +| `Disable_PrintSpoolerService.ps1` | Stops and disables the **Print Spooler** service. | Hardening / device script / remediation | +| `Enable_PrintSpoolerService.ps1` | Enables and starts the **Print Spooler** service. | Rollback / device script / remediation | +| `Get-IntuneAllAppsAssignmentDetails.ps1` | Uses Microsoft Graph to enumerate Intune apps and export assignment details (name/type/version/assignment/group) to CSV. | Tenant reporting / operations | +| `Initiate-MDMSync.ps1` | Triggers an MDM sync session on Windows and waits for completion (with timeout loop). | Device action / troubleshooting | +| `SmartCardLogonEnforcement.ps1` | Enables smart card logon enforcement and related registry settings, with logging under IME log path. | Win32 app / security baseline customization | +| `SmartCardLogonEnforcement_Disable.ps1` | Reverts smart card logon enforcement settings and removes prior enforcement log file. | Rollback Win32 app | +| `Test-IntuneConnectivity.ps1` | Pulls current M365/Intune endpoints and tests outbound connectivity (with proxy handling and category-based output). | Network troubleshooting / readiness validation | + +--- + +## Prerequisites + +### General +- Windows endpoint +- PowerShell 5.1+ (some scripts may also run on lower versions, but 5.1+ is recommended) +- Appropriate local permissions (several scripts modify services/registry and typically require elevated context) + +### Script-specific +- `Get-IntuneAllAppsAssignmentDetails.ps1` + - Internet access to Microsoft Graph + - Microsoft Graph PowerShell module (`Microsoft.Graph`) + - Entra app registration with required Graph app permissions for reading Intune app and group data +- `Test-IntuneConnectivity.ps1` + - Internet/proxy access to: + - `https://endpoints.office.com/...` + - Intune / M365 service endpoints returned by that feed +- `Detect-OfficeUpdateChannel.ps1` + - Access to Office Click-to-Run registry keys and: + - `https://clients.config.office.net/releases/v1.0/OfficeReleases` + +--- + +## Usage examples + +> Run scripts in a test environment first. + +### Run locally +```powershell +PowerShell.exe -ExecutionPolicy Bypass -File ".\Disable_PrintSpoolerService.ps1" +``` + +### Detection/remediation pattern (Intune Proactive Remediations) +- Detection script returns: + - `0` = compliant / no remediation + - non-zero (for example `1`) = remediation required +- `Detect - MultipleIntuneMDMCert.ps1` already follows this pattern. + +### Graph export script +`Get-IntuneAllAppsAssignmentDetails.ps1` exports to: +- `C:\Temp\Get-IntuneAllAppsAssignmentDetails.csv` + +Update these placeholders before use: +- `` +- `` +- `` + +--- + +## Notes and cautions + +- **Review before production use:** Some scripts directly change local security/service state (for example Spooler or smart card policies). +- **Test assignment scope:** In Intune, always validate with a pilot device group first. +- **Credential handling:** The Graph script currently uses a client secret inline placeholder; prefer secure secret storage (for example, Key Vault, managed identity patterns, secure runtime injection) for production workflows. +- **Logging:** Smart card scripts log to: + - `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\` + +--- + +## Suggested Intune packaging patterns + +- **Simple device scripts:** `Disable_PrintSpoolerService.ps1`, `Enable_PrintSpoolerService.ps1`, `Initiate-MDMSync.ps1` +- **Proactive remediations:** `Detect - MultipleIntuneMDMCert.ps1` (+ your remediation counterpart) +- **Win32 app deployment:** Smart card enforcement scripts with explicit install/uninstall mappings and detection logic using registry/log signals +- **Admin reporting utility (run by admin/operator):** `Get-IntuneAllAppsAssignmentDetails.ps1` + +--- + +## Contributing + +Contributions are welcome. If you add scripts, consider including: +- Clear purpose and expected context (System/User, Intune type) +- Input parameters and output behavior +- Exit code behavior (especially for detection scripts) +- Safety/rollback notes + +--- + +## License + +No license file is currently present in this repository. +If you plan to reuse or redistribute these scripts, add an explicit `LICENSE` file to define usage terms. From 43de9166dabcc30b1e187fe5b96265e054d3abaa Mon Sep 17 00:00:00 2001 From: John Gage Faulkner <46038619+johngagefaulkner@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:34:32 -0400 Subject: [PATCH 2/5] Rename Detect - MultipleIntuneMDMCert.ps1 to Detect-MultipleIntuneMDMCert.ps1 --- ... MultipleIntuneMDMCert.ps1 => Detect-MultipleIntuneMDMCert.ps1 | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename Detect - MultipleIntuneMDMCert.ps1 => Detect-MultipleIntuneMDMCert.ps1 (100%) diff --git a/Detect - MultipleIntuneMDMCert.ps1 b/Detect-MultipleIntuneMDMCert.ps1 similarity index 100% rename from Detect - MultipleIntuneMDMCert.ps1 rename to Detect-MultipleIntuneMDMCert.ps1 From ee1bd780faa00857e7f6c82022ca71d2b47c23dc Mon Sep 17 00:00:00 2001 From: John Gage Faulkner <46038619+johngagefaulkner@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:35:41 -0400 Subject: [PATCH 3/5] Update Detect-OfficeUpdateChannel.ps1 --- Detect-OfficeUpdateChannel.ps1 | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/Detect-OfficeUpdateChannel.ps1 b/Detect-OfficeUpdateChannel.ps1 index fbbe650..20c1c90 100644 --- a/Detect-OfficeUpdateChannel.ps1 +++ b/Detect-OfficeUpdateChannel.ps1 @@ -1,7 +1,6 @@ -try -{ - $ReportedVersion = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport" - $Channel = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "CDNBaseUrl" | Select-Object -Last 1 +try { + $ReportedVersion = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport" + $Channel = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "CDNBaseUrl" | Select-Object -Last 1 $CloudVersionInfo = Invoke-RestMethod 'https://clients.config.office.net/releases/v1.0/OfficeReleases' $UsedChannel = $cloudVersioninfo | Where-Object { $_.OfficeVersions.cdnBaseURL -eq $channel } if (($UsedChannel.channelId -eq "SemiAnnual") -and ($UsedChannel.latestversion -eq $ReportedVersion)) { @@ -12,10 +11,8 @@ Write-Host "Not using Semi-Annual channel. Detected channel is the $($UsedChannel.Channel) Channel." Exit 1 } -} -catch -{ +} catch { $errMsg = $_.Exception.Message Write-Host $errMsg Exit 1 -} \ No newline at end of file +} From 2bdf8f7b6badce98b2ff19b3a2ce65eae3ef2ab0 Mon Sep 17 00:00:00 2001 From: John Gage Faulkner <46038619+johngagefaulkner@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:36:18 -0400 Subject: [PATCH 4/5] Update Detect-OfficeUpdateChannel.ps1 --- Detect-OfficeUpdateChannel.ps1 | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Detect-OfficeUpdateChannel.ps1 b/Detect-OfficeUpdateChannel.ps1 index 20c1c90..810e7b1 100644 --- a/Detect-OfficeUpdateChannel.ps1 +++ b/Detect-OfficeUpdateChannel.ps1 @@ -1,6 +1,6 @@ -try { - $ReportedVersion = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport" - $Channel = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "CDNBaseUrl" | Select-Object -Last 1 +try { + $ReportedVersion = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport" + $Channel = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "CDNBaseUrl" | Select-Object -Last 1 $CloudVersionInfo = Invoke-RestMethod 'https://clients.config.office.net/releases/v1.0/OfficeReleases' $UsedChannel = $cloudVersioninfo | Where-Object { $_.OfficeVersions.cdnBaseURL -eq $channel } if (($UsedChannel.channelId -eq "SemiAnnual") -and ($UsedChannel.latestversion -eq $ReportedVersion)) { @@ -11,7 +11,8 @@ Write-Host "Not using Semi-Annual channel. Detected channel is the $($UsedChannel.Channel) Channel." Exit 1 } -} catch { +} +catch { $errMsg = $_.Exception.Message Write-Host $errMsg Exit 1 From 2982df60d405e899c944d442b482120b9fc203b3 Mon Sep 17 00:00:00 2001 From: John Gage Faulkner <46038619+johngagefaulkner@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:36:51 -0400 Subject: [PATCH 5/5] Update Detect-MultipleIntuneMDMCert.ps1 --- Detect-MultipleIntuneMDMCert.ps1 | 30 +++++++++++++----------------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/Detect-MultipleIntuneMDMCert.ps1 b/Detect-MultipleIntuneMDMCert.ps1 index 989b97d..da34ca2 100644 --- a/Detect-MultipleIntuneMDMCert.ps1 +++ b/Detect-MultipleIntuneMDMCert.ps1 @@ -1,22 +1,18 @@ -try -{ +try { # Get all certificates from Local Machine Personal store with Issuer matching Microsoft Intune MDM Device CA - $certificates = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Issuer -eq "CN=Microsoft Intune MDM Device CA"} - if(($certificates).Count -gt 1) - { - # Remediation needed on exit code 1 - Write-Output "Remediation needed" - Exit 1 - } - else - { - # Remediation not needed on exit code 0 - Write-Output "Remediation not needed" - Exit 0 - } + $certificates = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Issuer -eq "CN=Microsoft Intune MDM Device CA" } + if (($certificates).Count -gt 1) { + # Remediation needed on exit code 1 + Write-Output "Remediation needed" + Exit 1 + } + else { + # Remediation not needed on exit code 0 + Write-Output "Remediation not needed" + Exit 0 + } } -catch -{ +catch { $errMsg = $_.Exception.Message Write-Host $errMsg Exit 1