Script library
Short, read-only scripts that answer one question each: which devices have no BitLocker key in Entra ID, which users have no MFA method, which mailboxes forward outside the company.
Every cmdlet and parameter in every script is checked by a lint against cmdlet lists generated from Microsoft's published reference for the exact module version the script names. A script that uses a command or parameter Microsoft doesn't document, or one that changes anything, fails the check and isn't published. Last checked 2026-11-09.
Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.
12 of 12 scripts
Windows devices with no BitLocker recovery key in Entra ID
Which Windows devices registered in Microsoft Entra ID have no BitLocker recovery key stored in Entra ID? Those are the devices where a recovery prompt cannot be answered from the Entra or Intune admin centre.
Intune devices that haven't synced in N days
Which Intune-managed devices have not completed a successful sync with Intune in the last 30 days (or however many days you pass)?
Users with no MFA method registered
Which users have not registered a strong authentication method for multifactor authentication, according to the authentication methods registration report?
Export Conditional Access policies to JSON
What exactly do our Conditional Access policies say right now? Saves every policy to one JSON file you can diff or keep as a baseline before a change.
App registration secrets and certificates expiring soon
Which app registrations have a client secret or certificate that expires in the next 30 days, or has already expired?
Mailboxes forwarding to external addresses
Which mailboxes have mailbox-level forwarding (ForwardingSmtpAddress or ForwardingAddress) to an address outside your accepted domains?
BitLocker status of every volume on this PC
Is each volume on this Windows device encrypted, is protection on, and does it have a recovery password protector?
Windows Update policy values set in the registry
Which Windows Update policy values (Group Policy, WSUS server, Automatic Updates options) are actually present on this device?
Find clients making unsigned LDAP binds (events 2887 and 2889)
Before you require LDAP signing on a domain controller, which clients are still making unsigned SASL binds or simple binds over clear text?
Stale devices in Entra ID
Which devices registered in Microsoft Entra ID have not been used to sign in for 90 days (or the number of days you pass)?
Who holds each Entra ID directory role
Who is a member of each activated Microsoft Entra directory role (Global Administrator, Exchange Administrator and so on)?
Enabled AD computer accounts with no recent logon
Which enabled computer accounts in Active Directory have not logged on in the last 90 days (or the number of days you pass)?