The Toolkit
Assessment tools, diagnostics and automation for AVD, Windows 365, Intune and Windows endpoints — plus image-building pipelines, device lifecycle scripts and macOS developer-storage cleanup. Everything here lives in endpoint-toolkit. Check each tool's license and prerequisites before use.
Azure Virtual Desktop
AvdAssessor
Review AVD against CAF/WAF guidance with Azure discovery, a workshop checklist and exportable findings. Optional Graph, telemetry and in-guest checks require additional permissions.
AIBLogMonitor
Discover active Azure Image Builder runs, stream Packer logs and inspect build phases, error clusters and build-health analytics.
AvdRewind
Snapshot, compare and selectively restore AVD control-plane topology — host pools, workspaces, application groups and scaling plans. Configuration recovery, not VM disk or image rollback.
AVD image customizers
AIB / Packer image-bake customizers — admin sysprep, disable auto-update, language packs, appx removal, timezone redirection, WinGet update and a VDOT optimization wrapper with bundled configuration JSON.
AVD lifecycle helpers
Host-pool drain, deployment telemetry, FSLogix repair, stub-app payload capture/install, hybrid activation and session-host removal.
AVD deployment templates
Bicep templates and reusable modules for AVD session hosts and image templates, with Entra ID and AD-joined deployment variants.
AVD DevOps pipelines
Azure DevOps YAML pipelines for image builds, host-pool updates and activation. Configure the environment-specific values before use.
Azure Image Builder Task v2
Community-maintained Azure DevOps task for Azure Image Builder, with a modern Node.js runtime, updated API support and build progress reporting.
Windows 365
W365Assessor
Windows 365 (Cloud PC) tenant assessment for Enterprise and Flex (formerly Frontline), with 132 checks and Microsoft Graph discovery.
Windows 365 utilities
Expand the OS partition after a Cloud PC disk resize, and configure keyboard layouts for user, default-user and system contexts.
Intune
PolicyPilot
Group Policy and MDM documentation — scans AD, Local and Intune, detects conflicts and enriches with ADMX/CSP metadata.
mdmresult
Generate a local gpresult-style HTML report for Group Policy and Intune/MDM policy state, enriched with ADMX/CSP metadata, conflicts, app results and device evidence. Read-only; local health is not Intune compliance.
ADMXPolicyComparer
Compare ADMX/ADML administrative templates across Windows versions, including policy and registry metadata changes. Export HTML or CSV diffs.
Intune Discovery for Assay
Export read-only Microsoft Graph observations for Assay's Intune pack. Assay owns the controls and scoring. Experimental collector; live-tenant pilot validation is still pending.
BitLocker remediations
Detect and remediate BitLocker recovery-key escrow to Entra ID, with optional legacy MBAM agent removal after escrow is confirmed.
Intune client health
Screen for major local Intune service, enrollment, certificate and task faults through a self-contained ConfigMgr compliance discovery script. Writes detailed local evidence; read-only, with no sync or repair.
Intune enrollment repair
Audit expired MDM device certificates or explicitly repair affected enrollment. Repair removes the old enrollment and re-enrolls using device credentials; review the prerequisites before running it.
Intune MDM health & sync
Detect and repair a disabled dmwappushservice, collect local enrollment, certificate, task, network and IME evidence, and optionally submit one guarded PushLaunch sync request. No re-enrollment or service restart.
OneDrive Photos shortcuts
Temporarily remove Start Menu and Desktop shortcuts targeting OneDrive.App.exe, with a WhatIf preview. Cosmetic mitigation only: the app remains installed and launchable from Search.
Security
BaselinePilot
Assess Windows 11 security baselines and operational health — 312 checks with an exportable report.
Speculation & Secure Boot
Hardware speculation mitigations and Secure Boot UEFI CA 2023 detection, remediation and fleet inventory. Review platform prerequisites and change impact before applying settings.
RDP file signing
Sign RDP files individually or in batches using an existing code-signing certificate. Supports per-user trusted-publisher configuration without administrator rights.
Diagnostics
DumpPilot
Run cdb against Windows crash dumps, extract structured facts and generate reports and AI-review prompts. Optionally correlate Process Monitor traces with the dump.
Windows diagnostics
Investigate Location policy, Defender/EDR coexistence, Delivery Optimization, power and audio artifacts, NTLM use, and Microsoft service endpoint connectivity including proxy/TLS evidence. Audio recording requires explicit privacy approval.
Windows Operations
Windows servicing
Pre-upgrade disk cleanup, Windows Setup timeline analysis, WinRE partition resizing and EFI System Partition free-space reporting for fleet monitoring.
Print readiness (WPP)
Flag machines with third-party v3/v4 print drivers not yet ready for Windows Protected Print, as an Intune detection plus fleet inventory.
Windows configuration
Adjust Windows 11 startup-app delays and Modern Standby power plans, and query or configure processor boost on the active plan. Changes require elevation and modify local configuration.
Device Lifecycle
DeviceDecommissioner
Remove one device from AD, Entra ID, Intune, Autopilot and Configuration Manager after per-system review and typed confirmation. Includes dry-run, BitLocker/LAPS warnings and separate read-only inventory.
Windows application cleanup
Uninstall MSI products through registry-based discovery, or remove outdated per-user AppX/MSIX registrations below an approved version. The AppX cleanup supports WhatIf and leaves provisioning unchanged.
Device join & enrollment migration
Experimental EntraCutover for an in-place hybrid-to-Entra join change not supported by Microsoft, plus stale MDM enrollment detection and destructive cleanup. Validate in a lab before use.
Wired authentication reset
Reset the Wired AutoConfig migration flag and restart dot3svc to reprocess wired 802.1X profiles after migration. Plan for the service restart and possible connectivity impact.
Desktop Tools
AzChangeTracker
Snapshot Azure subscription resources, compare additions, removals and property changes, classify severity and export reports.
WinGetManifestManager
Create, edit and publish WinGet package manifests, and manage a private Azure-backed REST source from a PowerShell/WPF desktop app.