Add README with Intune script samples and guidelines

Detect-MultipleIntuneMDMCert.ps1

@@ -0,0 +1,19 @@
+try {
+    # Get all certificates from Local Machine Personal store with Issuer matching Microsoft Intune MDM Device CA
+    $certificates = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Issuer -eq "CN=Microsoft Intune MDM Device CA" }
+    if (($certificates).Count -gt 1) {
+        # Remediation needed on exit code 1
+        Write-Output "Remediation needed"
+        Exit 1
+    }
+    else {
+        # Remediation not needed on exit code 0
+        Write-Output "Remediation not needed"
+        Exit 0
+    }
+}
+catch {
+    $errMsg = $_.Exception.Message
+    Write-Host $errMsg
+    Exit 1
+}

Detect-OfficeUpdateChannel.ps1

@@ -1,5 +1,4 @@
-try 
-{
+try {
     $ReportedVersion = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "VersionToReport"
     $Channel = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -Name "CDNBaseUrl" | Select-Object -Last 1
     $CloudVersionInfo = Invoke-RestMethod 'https://clients.config.office.net/releases/v1.0/OfficeReleases'
@@ -13,9 +12,8 @@
         Exit 1   
     }
 }
-catch
-{
+catch {
     $errMsg = $_.Exception.Message
     Write-Host $errMsg
     Exit 1
-}
+}

README.md

@@ -0,0 +1,113 @@
+# Intune Script Samples
+
+PowerShell script samples for common Microsoft Intune and endpoint management scenarios.
+
+This repository contains practical scripts you can use for:
+
+- Intune proactive remediation detection logic
+- Local endpoint configuration changes (services/registry)
+- Intune connectivity validation from client devices
+- Microsoft Graph reporting for Intune app assignments
+- Forcing an MDM sync on Windows devices
+
+Repository: https://github.com/jbasuroy369/Intune-Script-Samples
+
+---
+
+## Scripts included
+
+| Script | Purpose | Typical Intune Use |
+|---|---|---|
+| `Detect - MultipleIntuneMDMCert.ps1` | Detects if more than one **Microsoft Intune MDM Device CA** certificate exists in `LocalMachine\My`. Exits `1` if remediation is needed. | Proactive Remediations (Detection script) |
+| `Detect-OfficeUpdateChannel.ps1` | Detects Office Click-to-Run channel/version against Microsoft Office releases endpoint and validates Semi-Annual + latest version logic. | Compliance check / detection workflow |
+| `Disable_PrintSpoolerService.ps1` | Stops and disables the **Print Spooler** service. | Hardening / device script / remediation |
+| `Enable_PrintSpoolerService.ps1` | Enables and starts the **Print Spooler** service. | Rollback / device script / remediation |
+| `Get-IntuneAllAppsAssignmentDetails.ps1` | Uses Microsoft Graph to enumerate Intune apps and export assignment details (name/type/version/assignment/group) to CSV. | Tenant reporting / operations |
+| `Initiate-MDMSync.ps1` | Triggers an MDM sync session on Windows and waits for completion (with timeout loop). | Device action / troubleshooting |
+| `SmartCardLogonEnforcement.ps1` | Enables smart card logon enforcement and related registry settings, with logging under IME log path. | Win32 app / security baseline customization |
+| `SmartCardLogonEnforcement_Disable.ps1` | Reverts smart card logon enforcement settings and removes prior enforcement log file. | Rollback Win32 app |
+| `Test-IntuneConnectivity.ps1` | Pulls current M365/Intune endpoints and tests outbound connectivity (with proxy handling and category-based output). | Network troubleshooting / readiness validation |
+
+---
+
+## Prerequisites
+
+### General
+- Windows endpoint
+- PowerShell 5.1+ (some scripts may also run on lower versions, but 5.1+ is recommended)
+- Appropriate local permissions (several scripts modify services/registry and typically require elevated context)
+
+### Script-specific
+- `Get-IntuneAllAppsAssignmentDetails.ps1`
+  - Internet access to Microsoft Graph
+  - Microsoft Graph PowerShell module (`Microsoft.Graph`)
+  - Entra app registration with required Graph app permissions for reading Intune app and group data
+- `Test-IntuneConnectivity.ps1`
+  - Internet/proxy access to:
+    - `https://endpoints.office.com/...`
+    - Intune / M365 service endpoints returned by that feed
+- `Detect-OfficeUpdateChannel.ps1`
+  - Access to Office Click-to-Run registry keys and:
+    - `https://clients.config.office.net/releases/v1.0/OfficeReleases`
+
+---
+
+## Usage examples
+
+> Run scripts in a test environment first.
+
+### Run locally
+```powershell
+PowerShell.exe -ExecutionPolicy Bypass -File ".\Disable_PrintSpoolerService.ps1"
+```
+
+### Detection/remediation pattern (Intune Proactive Remediations)
+- Detection script returns:
+  - `0` = compliant / no remediation
+  - non-zero (for example `1`) = remediation required
+- `Detect - MultipleIntuneMDMCert.ps1` already follows this pattern.
+
+### Graph export script
+`Get-IntuneAllAppsAssignmentDetails.ps1` exports to:
+- `C:\Temp\Get-IntuneAllAppsAssignmentDetails.csv`
+
+Update these placeholders before use:
+- `<Your Entra Registered App ID here>`
+- `<Your Tenant ID here>`
+- `<Your Entra Registered App Client Secret here>`
+
+---
+
+## Notes and cautions
+
+- **Review before production use:** Some scripts directly change local security/service state (for example Spooler or smart card policies).
+- **Test assignment scope:** In Intune, always validate with a pilot device group first.
+- **Credential handling:** The Graph script currently uses a client secret inline placeholder; prefer secure secret storage (for example, Key Vault, managed identity patterns, secure runtime injection) for production workflows.
+- **Logging:** Smart card scripts log to:
+  - `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\`
+
+---
+
+## Suggested Intune packaging patterns
+
+- **Simple device scripts:** `Disable_PrintSpoolerService.ps1`, `Enable_PrintSpoolerService.ps1`, `Initiate-MDMSync.ps1`
+- **Proactive remediations:** `Detect - MultipleIntuneMDMCert.ps1` (+ your remediation counterpart)
+- **Win32 app deployment:** Smart card enforcement scripts with explicit install/uninstall mappings and detection logic using registry/log signals
+- **Admin reporting utility (run by admin/operator):** `Get-IntuneAllAppsAssignmentDetails.ps1`
+
+---
+
+## Contributing
+
+Contributions are welcome. If you add scripts, consider including:
+- Clear purpose and expected context (System/User, Intune type)
+- Input parameters and output behavior
+- Exit code behavior (especially for detection scripts)
+- Safety/rollback notes
+
+---
+
+## License
+
+No license file is currently present in this repository.  
+If you plan to reuse or redistribute these scripts, add an explicit `LICENSE` file to define usage terms.