A comprehensive repository of production PowerShell scripts and automation tools for managing Microsoft Intune (Endpoint Manager), Windows Autopilot, BitLocker, Device Configuration Profiles, NDES / SCEP Certificates, Firmware / Driver updates, and Win32 Application deployments.
Automation scripts for app packaging, store metadata, and Win32 application lifecycle:
Get-MSIntuneApp.ps1— Queries managed Intune applications across all platforms.Get-StoreAppInformation.ps1— Extracts app details and package IDs directly from Microsoft Store / App Store APIs.New-MSIntuneWin32App.ps1— Automates Win32 application creation via Microsoft Graph.InstallOffice.ps1/OfficeWin32DetectionScript.ps1— Scripted Microsoft 365 Apps deployment and custom detection.Install-VCRedist.ps1/Get-VCRedistDetection.ps1— Visual C++ Redistributable multi-architecture silent installer and registry detector.Get-IntuneiOSManagedAppAssignment.ps1/New-MSIntuneiOSAppAssignment.ps1— Configures iOS volume-purchase and store app assignments.
Tools for hardware registration, enrollment status, and OOBE optimization:
Upload-WindowsAutopilotDeviceInfo.ps1— Captures hardware hash and registers the device into Windows Autopilot via Graph API.Set-AutopilotDeviceGroupTag.ps1— Bulk-assigns GroupTags to Autopilot devices based on hardware inventory or purchase orders.Test-AutopilotAzureADDeviceAssociation.ps1— Validates Entra ID / Intune object synchronization during enrollment.Get-AzureADDeviceRecordsBySerialNumber.ps1— Locates Entra ID device identities by hardware serial number.Set-WindowsTimeZone.ps1— Sets correct system time zone during Autopilot provisioning.Invoke-OneDriveSetupUpdate.ps1— Pre-provisions and configures OneDrive Known Folder Move during initial setup.
Enterprise encryption and key escrow auditing:
Enable-BitLockerEncryption.ps1— Enforces silent XTS-AES 256-bit BitLocker drive encryption without user intervention.Get-BitLockerEncryptionDetection.ps1— Custom detection rule verifying BitLocker encryption status and protector types.Get-IntuneManagedDeviceBitLockerKeyPresence.ps1— Verifies that BitLocker recovery keys have been successfully escrowed into Entra ID.
PKI infrastructure and certificate lifecycle management:
Install-MSIntuneNDESServer.ps1— Automated setup and configuration of the Intune Certificate Connector on NDES servers.Get-SCEPCertificateDetection.ps1— Validates SCEP certificate issuance and renewal status on endpoints.Update-SCEPCertificate.ps1— Triggers SCEP certificate renewal when expiration thresholds are approached.Get-MDMInformation.ps1— Inspects MDM enrollment certificates and OMA-DM device URIs.
Backup, restore, and profile management:
Export-IntuneDeviceConfigurationProfile.ps1— Exports all Intune configuration profiles (OMA-URI, Settings Catalog, Administrative Templates) to JSON.Import-IntuneDeviceConfigurationProfile.ps1— Imports configuration profiles from JSON for tenant-to-tenant migration or backup restoration.Rename-IntuneDeviceConfigurationProfile.ps1— Enforces standardized profile naming conventions across policies.
Automated hardware updates across vendor hardware:
Invoke-HPDriverUpdate.ps1— Automates HP Image Assistant (HPIA) driver and BIOS deployment via Intune.Invoke-MSIntuneDriverUpdate.ps1— Manages Intune Windows Driver Update rings.Invoke-IntuneBIOSUpdate-Detect.ps1/Invoke-IntuneBIOSUpdate-Remediate.ps1— Detects outdated system BIOS and orchestrates silent firmware flashing.Invoke-BiosInventoryToLA.ps1— Streams endpoint BIOS and microcode versions into Azure Log Analytics.
Enterprise desktop configuration utilities:
Install-CloudLAPS_SchTask.ps1— Configures scheduled task enforcement for Cloud LAPS password rotation.Install-Printer.ps1/Remove-Printer.ps1— Network and IP printer deployment via PowerShell without print servers.Enable-OneDriveADAL.ps1— Enforces modern authentication for OneDrive sync clients.Create-gMSA.ps1/Create-ADGroups.ps1— On-premises Active Directory integration for hybrid environments.
Get-AppleMDMPushCertificateExpiration.ps1— Monitors Apple Push Notification service (APNs) certificate validity and warns before expiry.Monitor-IntuneAppleConnectors.ps1— Audits Apple VPP (Volume Purchase Program) and Automated Device Enrollment (ADE/DEP) tokens.Invoke-DelayedTargetingGroup.ps1— Staged deployment automation holding devices in a staging group before advancing to ring 1.Check-UpdateComplianceSetting.ps1— Verifies Windows Update for Business (WUfB) telemetry and compliance configuration.
Most scripts in this repository utilize Microsoft Graph PowerShell SDK:
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All", "DeviceManagementApps.ReadWrite.All"Or use the included authentication helper in Authentication/Get-MSGraphAuthenticationToken.ps1 for app registration / service principal authentication with client secrets or certificates.