Maester Packs
LowScript packFree

RKSolutions Intune Anomalies

Finds what needs attention in Microsoft Intune before it becomes a problem: devices that miss protection, drift out of compliance or fall out of management, and policies that still rely on outdated settings.

Version
0.1.2
Tests
8
Connectors
0
Published
26 Oct 2026

royklo · royklo.rksolutions-intune-anomalies · 0 stars · Open source · MIT

PowerShell 
Install-MtPack royklo/maester-pack-rksolutions/intune-anomalies

Install only packs from sources you trust. This pack is made by royklo, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/royklo/maester-pack-rksolutions.

maester-packs.lock.json entry 
{  "Id": "royklo.rksolutions-intune-anomalies",  "Source": "royklo/maester-pack-rksolutions/intune-anomalies",  "Version": "0.1.2",  "Commit": "afa83af9cb197e96ba3c2571d8d26a67da3b6c9d",  "Digest": "sha256:2749b38eff701319ff21a3d7f3e93044c819052b2a64a8e3398edd11f56e69fe"}

Overview #

Checks your Microsoft Intune tenant for anomalies in device protection, compliance, enrollment and policy settings. The checks grow with each release.

Script packPowerShell files only.

Intune

Install #

PowerShell 
Install-MtPack royklo/maester-pack-rksolutions/intune-anomalies

The pack also needs:

  1. PowerShell 7.4 or later and Maester 3.0 or later.

  2. An account that can read Intune and, for the BitLocker and LAPS checks, read BitLocker keys and LAPS password metadata (the Global Reader role is enough; so is Intune Administrator).

Connect #

  1. Connect to Microsoft Graph with Maester's scopes plus the two this pack also needs. Maester's own scope check then passes, so no extra switch is needed.

    PowerShell 
    Connect-MgGraph -Scopes ((Get-MtGraphScope) + 'BitlockerKey.ReadBasic.All', 'DeviceLocalCredential.ReadBasic.All') -NoWelcome

If access is denied (a missing scope or a missing role), the BitLocker and LAPS checks are skipped with the reason, and the other checks run.

Run #

  1. Only this pack

    PowerShell 
    Invoke-Maester -Pack RKS.IA -SkipBuiltIn

  2. Maester's tests and this pack

    PowerShell 
    Invoke-Maester -Pack RKS.IA

App-only #

Runs without a signed-in user, as an app, for example in a pipeline.

CertificateClient secretManaged identityWorkload identity federation

Give the app the application permissions listed below, connect with Connect-MgGraph, and run Invoke-Maester -Pack RKS.IA -SkipBuiltIn -SkipGraphConnect -NonInteractive (-SkipGraphConnect skips Maester's check for its own Graph permissions, which an app made for this pack alone does not hold).

Microsoft Graph permissions (6)
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementServiceConfig.Read.All
  • BitlockerKey.ReadBasic.All
  • DeviceLocalCredential.ReadBasic.All
  • Directory.Read.All

Tests #

8 tests, about:

  • Intune 8

See all tests

Security #

Low Text files only, and every scan passed.

What the pack reaches and what the scan found

Support #

README #

RKSolutions Intune Anomalies

A Maester Pack with eight checks of the Windows devices that Intune manages. The checks come from the Intune Anomalies report of the RKSolutions PowerShell module.

Install and run

Install-MtPack royklo/maester-pack-rksolutions/intune-anomalies

A specific version is installed by its release tag:

Install-MtPack royklo/maester-pack-rksolutions/intune-anomalies -Version intune-anomalies-v0.1.0

Then connect and run:

Connect-MgGraph -Scopes ((Get-MtGraphScope) + 'BitlockerKey.ReadBasic.All', 'DeviceLocalCredential.ReadBasic.All') -NoWelcome
Invoke-Maester -Pack RKS.IA

An account with the Global Reader role is enough (Intune Administrator also works). The first test of a run collects the data for all eight, which can take minutes on a large tenant; keep that in mind if Execution.TestTimeoutSeconds is set in your Maester configuration.

If Graph answers access denied for BitLocker keys or LAPS passwords, those two checks are skipped. Check both that the connection has the two extra scopes and that the account has a role that may read them (Global Reader does).

Settings

Three tests take parameters. Set them in maester-config.json under TestSettings, by test ID:

{
  "TestSettings": [
    { "Id": "MP.RKS.IA.1002", "Parameters": { "MaximumBackupAgeDays": 30, "IncludeExcludedDevices": true } },
    { "Id": "MP.RKS.IA.1004", "Parameters": { "InactiveDays": 45 } }
  ]
}
Test Parameter Default
MP.RKS.IA.1001, MP.RKS.IA.1002 IncludeExcludedDevices false
MP.RKS.IA.1002 MaximumBackupAgeDays 60
MP.RKS.IA.1004 InactiveDays 90

Tests

ID Title
MP.RKS.IA.1001 Windows devices are BitLocker-encrypted and their recovery key is in Entra ID
MP.RKS.IA.1002 Windows devices back up their local administrator password to Entra ID
MP.RKS.IA.1003 Windows devices are compliant
MP.RKS.IA.1004 Windows devices have checked in with Intune recently
MP.RKS.IA.1005 The primary user of every Windows device is enabled
MP.RKS.IA.1006 Windows devices are registered in Windows Autopilot
MP.RKS.IA.1007 Single-user Autopilot devices are used by one person
MP.RKS.IA.1008 Settings Catalog policies use no deprecated settings

A failing test lists up to 200 devices or settings. For the full list, run the HTML report Get-IntuneAnomaliesReport from the RKSolutions module (Install-Module RKSolutions).

Where the code comes from

helpers/core is copied from module/Core of RKSolutions-Module by a pull request. Change the logic there, not here.