A practical toolkit for Microsoft Intune administrators. This repository brings together PowerShell scripts, remediations, security baselines, Win32 packaging, Dell hardware management, and macOS configuration so you can manage Windows, macOS, and Microsoft 365 endpoints from one place.

Use it as a starting point for production Intune work: copy what you need, test in a lab, then assign in Microsoft Intune.

Author: Allester Padovani — Intune and Microsoft 365 specialist focused on endpoint management, identity, and cloud security.

• What this repo includes
• Repository layout
• Prerequisites
• How to use these scripts
• Module details
  • Intune Endpoint Management
  • Windows 11 detection and remediation
  • Security baselines
  • macOS management scripts
  • Dell tools install and uninstall
  • Dell detection and remediation
  • Win32 packaging tool
  • ServiceUI for Win32 app installs
• Safety notes
• License
• Connect

Intune Endpoint Management/
Intune Windows 11 Detection & Remediation/
Intune Security Baseline/
Intune macOS Management Scripts/
Intune Windows Dell Tools Install & Uninstall/
Intune Windows Dell Detection & Remediation/
Intune Win32 Packaging Tool/
Intune Windows App Install ServiceUI/

• A Microsoft Intune licensed tenant and an account with enough permissions to create policies, apps, and remediations
• Windows PowerShell 5.1 or PowerShell 7 for most Windows scripts
• Microsoft Graph PowerShell for Microsoft 365 / Entra reporting scripts
• .NET Framework 4.7.2 for the Win32 Content Prep Tool
• Dell Command | Configure, Dell Command | Update, and related Dell tools for Dell-specific remediations
• Test devices (or Autopilot / Windows 365 lab VMs) before you assign anything broadly

Most Windows 11 and Dell folders follow the Intune remediations pattern:

1. Open Intune admin center > Devices > Remediations.
2. Create a script package.
3. Paste the Detect_*.ps1 script as detection and Remediate_*.ps1 as remediation.
4. Detection should exit 0 when the device is healthy and exit 1 when remediation should run.
5. Assign to a pilot group first, then expand.

1. Put the installer and the matching install / uninstall / detection scripts in one folder.
2. Package with the Win32 Content Prep Tool into an .intunewin file.
3. Upload the package in Intune > Apps > Windows.
4. Use the detection script as the detection rule.

Import the JSON files with the Intune Management tool in this repo, or use native Intune import where the folder is named NativeImport. Review every setting against your environment before assignment.

Run the reporting scripts from an elevated PowerShell session. Sign in when prompted (interactive, or certificate-based auth where the script supports it). CSV output is written to the current directory.

Admin and Microsoft 365 operations scripts.

Proactive remediations grouped by job:

• Device compliance — BitLocker, Credential Guard, Device Guard, firewall, Secure Boot, custom file / registry checks
• Device configuration — UAC, WDAC, time zone, certificates, VPN, wallpaper, drive mapping, Office / Outlook templates, DNS
• Microsoft Defender Antivirus — real-time protection, cloud-delivered protection, network protection, PUA, tamper protection, scans, and intelligence updates
• Device performance — disk cleanup, low disk space, user profiles, system performance, inactive local / Entra users
• Reporting — uptime, software inventory, BitLocker, certificates, firewall, local admins, pending reboot, event log errors
• Toast notifications — reboot required, pending updates, low disk, high CPU / memory, printer issues, network, battery, antivirus
• Miscellaneous — Windows AI registry, SoftwareDistribution folder, generic registry and service restarts
• ToastCreator — helper for building toast notifications

Opinionated Intune baselines (often labeled OIB) ready to import:

Win32-ready install, uninstall, and detection scripts for Dell management software:

• Dell Command | Update, Configure, Monitor, and Endpoint Configure for Microsoft Intune
• Dell Display Manager / Display and Peripheral Manager
• Dell Optimizer, Power Manager, Peripheral Manager, Trusted Device
• Dell SupportAssist for Business
• Microsoft .NET Desktop Runtime 8 and ASP.NET Core 8 (common Dell dependencies)

Universal App Scripts can install or update several Dell tools from one package when the installer files sit next to the script.

Custom compliance sensors and remediations for Dell PCs:

• BIOS admin password, Fastboot, thermal mode, and other BIOS settings
• SafeBIOS / indicators of attack
• Dell Command | Update critical drivers
• Warranty / out-of-warranty status
• Battery health and chassis intrusion
• Display ComfortView and related settings

Review any script named do_not_use before you assign it. Those are marked as not ready for production.

Microsoft Win32 Content Prep Tool. It converts a setup folder into an .intunewin package for Intune Win32 apps.

IntuneWinAppUtil -c <setup_folder> -s <setup.exe_or.msi> -o <output_folder> -q

Run IntuneWinAppUtil -h for full usage. Keep generated .intunewin files as secure as the original installers; they contain encrypted source files.

ServiceUI helpers for Win32 apps that need to interact with the logged-on user (for example, a visible installer or prompt) while Intune runs the package in the system context. x64 and x86 originals are included.

• Run every script in a test ring before production. BIOS, compliance, and uninstall scripts can break devices if settings do not match your hardware or tenant.
• Some Microsoft Graph scripts need high-privilege directory permissions. Use least privilege and an app registration with certificate auth when you schedule them.
• Dell BIOS remediations may require a BIOS administrator password and Dell Command | Configure. Confirm the password handling in each script before you deploy.
• This collection includes tools and samples from Microsoft, Dell, and the Intune community. Read the header comments and any LICENSE or README in a subfolder before you redistribute.

This repository is a curated collection. Individual folders may use different licenses (MIT, Apache 2.0, Microsoft software terms, and others). Check the files in each module. There is no single license that covers every script.

The software is provided as-is, without warranty. You are responsible for testing and for any change you make in your tenant.

• LinkedIn: Allester Padovani
• GitHub: IntuneAdministrator

If a script helps you, star the repo or open an issue with what you changed in your environment.