Assess local prerequisites, confirm Azure Arc enrolment, plan baseline restarts and prove the patch outcome. Includes a reusable PowerShell toolkit, official portal screenshots and evidence templates.
Article collection
PowerShell and automation
PowerShell and Microsoft Graph for repeatable administration: read-only audits, evidence collection and scripts other administrators can run safely.
Published guidance
Auto-enrolment fails silently until certificates expire and authentication breaks. A read-only script that finds the certificates about to lapse, tests the certification authorities and reports who actually holds enrol rights.
A user exists on-premises, does not exist in the cloud, and sync reports success. A read-only triage script that finds the objects Entra ID quarantined and explains which attribute caused it.
Application secrets expire quietly and fail loudly, usually out of hours. A read-only script that lists every credential in the tenant with its expiry, owner and blast radius.
Delegated and application permissions are not two settings on the same dial. One is bounded by the signed-in user and one is not, and the difference decides your exposure.
The SDK asks for the permissions you name, and most people name too many. Two discovery cmdlets tell you exactly what a command needs, which makes least privilege straightforward.
The sign-in log answers questions the portal makes awkward: legacy authentication by application, failures by error code, and which accounts are risky right now.
Hybrid join failures are diagnosed by a tool that prints eighty lines of state nobody reads. A script that parses it, names the failing phase and checks the service connection point.
The Intune portal tells you a device is non-compliant. It takes several clicks to learn which policy, and there is no clicking your way through nine hundred devices. A script that answers it in one pass.
An Owner who cannot read a secret, a firewall that looks open, and a private endpoint resolving to the wrong address all produce the same status code. A script that separates them.
Enforcing LDAP signing and channel binding is a five-minute change that breaks printers, scanners and appliances nobody documented. A script that finds them first, from the domain controllers' own evidence.
Audits, incidents and reviews all ask the same questions about a tenant. Collecting the answers the same way every time turns an ad-hoc scramble into a comparable record.
NTLM is deprecated, NTLMv1 is already removed from the newest Windows releases, and nobody has an inventory. A read-only script that collects what is actually authenticating with NTLM, from the machines that know.
A script that works is not the same as a script someone else can run at two in the morning. The difference is a small number of habits, and they cost almost nothing to adopt.
A read-only assessment that collects privileged membership, delegation, stale accounts and password policy exposure — and changes nothing, deliberately.
Deleting a dormant account is easy. Knowing whether something still depends on it is the actual work, and LastLogonDate will not tell you.
Group Policy applies differently depending on which domain controller a client used. A read-only health check for DFSR SYSVOL, and the one recovery step that is safe to automate.
Windows 10 reached end of support in October 2025. A script that reports, per device, which Windows 11 requirement it fails — and says plainly which answers it cannot give you.
A practical readiness plan for discovering EWS dependencies, controlling temporary access and moving Exchange Online integrations forward.