Maester Packs
LowScript packFree

RKSolutions Intune Anomalies

Finds what needs attention in Microsoft Intune before it becomes a problem: devices that miss protection, drift out of compliance or fall out of management, and policies that still rely on outdated settings.

Version
0.1.2
Tests
8
Connectors
0
Published
26 Oct 2026

royklo · royklo.rksolutions-intune-anomalies · 0 stars · Open source · MIT

PowerShell 
Install-MtPack royklo/maester-pack-rksolutions/intune-anomalies

Install only packs from sources you trust. This pack is made by royklo, not by Maester. The site only indexes and scans it: Install-MtPack downloads it straight from github.com/royklo/maester-pack-rksolutions.

maester-packs.lock.json entry 
{  "Id": "royklo.rksolutions-intune-anomalies",  "Source": "royklo/maester-pack-rksolutions/intune-anomalies",  "Version": "0.1.2",  "Commit": "afa83af9cb197e96ba3c2571d8d26a67da3b6c9d",  "Digest": "sha256:2749b38eff701319ff21a3d7f3e93044c819052b2a64a8e3398edd11f56e69fe"}

← All tests

MP.RKS.IA.1001 Windows devices are BitLocker-encrypted and their recovery key is in Entra ID

Severity: HighGraph

Every Windows device should be encrypted with BitLocker, be covered by an Intune BitLocker policy, and have the recovery key of its system drive stored in Microsoft Entra ID. A lost or stolen laptop without BitLocker gives away its data. A device whose key is not in Entra ID cannot be unlocked by the helpdesk when BitLocker asks for the key.

The test lists each device with what is wrong: not encrypted, no BitLocker policy assigned, or encrypted without a key in Entra ID. Cloud PCs are left out: Windows 365 encrypts their disks itself.

Remediation action

  1. In the Microsoft Intune admin center, go to Endpoint security > Disk encryption.
  2. Make sure a BitLocker policy is assigned to these devices, with Require Device Encryption on and recovery information stored in Entra ID.
  3. For an encrypted device without a key in Entra ID, run BackupToAAD-BitLockerKeyProtector on the device, or make the policy back up the key and let the device sync.

Related links

%TestResult%