INTUNE-018: PowerShell script deployment audit
- Platform
- Entra ID / M365
- Category
- Intune / Endpoint Management
- Severity
- Critical
- Zero Trust pillar
- Devices (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Intune allows administrators to deploy PowerShell scripts to managed Windows devices, which execute with SYSTEM-level privileges by default. Malicious or poorly written scripts deployed through this channel can compromise device security, exfiltrate data, or install unauthorized software across the entire fleet. Every deployed script must be reviewed for security implications and tracked for authorized deployment.
Recommended value
All deployed scripts reviewed and approved through change management; scripts run in user context where possible; script content documented
Remediation
Audit all PowerShell scripts currently deployed through Intune and review their content for security risks such as hardcoded credentials, unrestricted remote downloads, or excessive permission changes. Ensure that scripts run in the user context rather than SYSTEM context wherever possible and that script execution is limited to the minimum required device scope. Implement a change management process for script deployment that includes peer review of script content and formal approval before production deployment.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6
- MITRE ATT&CK
- T1059.001