Scripts

Comprehensive Microsoft 365 audit: an Excel report of every mailbox (licences, MFA status, last logon, size, aliases, delegates) plus a text report of per-domain email security (MX, SPF, DKIM), licence counts, and risky findings like forwarding rules and admin-role holders. Note: uses the legacy MSOnline module, which Microsoft is retiring.

Adds every member (non-guest) user in the tenant to an Entra ID security group you choose at runtime. Note: uses the legacy AzureAD module (being retired); Microsoft Graph is the successor.

Sets legacy per-user MFA to Enabled then Enforced for all member users. Useful for small tenants not yet on Conditional Access. Note: uses the legacy MSOnline module, which Microsoft is retiring.

Clears legacy per-user MFA state for all member users, for example before migrating enforcement to Conditional Access. Note: uses the legacy MSOnline module, which Microsoft is retiring.

Exports every mailbox and Microsoft 365 group SMTP alias to CSV. Handy for finding which address is attached where.

Adds every mailbox user to the protected-users list of a Defender for Office 365 anti-phishing (impersonation) policy you select.

Send a test email from PowerShell three ways: authenticated SMTP (TLS on port 587), an unauthenticated internal relay, or direct to a Microsoft 365 mail connector (the MX endpoint on port 25). Includes an MX-lookup helper. Handy for confirming a mail relay works and for security and relay testing.

Queries the common DKIM selectors (default, s1/s2, selector1/2) for a domain via DNS and reports which records exist.

Reports the number of messages sent per internal user per day from Exchange Online message trace, exported to CSV. Note: Get-MessageTrace covers only the last 10 days and is being replaced by Get-MessageTraceV2.

Checks every user in a Microsoft 365 tenant against Have I Been Pwned and produces a searchable HTML plus CSV breach report. Needs a paid HIBP API key, and uses the legacy AzureAD module (being retired).

As above, with Microsoft Partner Center support so you can pick and scan any client tenant you manage. Needs a paid HIBP API key.

Exports all external / guest users across SharePoint Online (site-wise or tenant-wide) to CSV.

Reports each SharePoint Online site's external-sharing capability (in plain English) along with last-modified date and storage usage, to CSV.

Collects a device security posture (local admins, inactive and passwordless accounts, RDP, firewall, Microsoft Defender for Endpoint, and BitLocker per drive) and writes it to JSON plus the console. No external database.

Lists any enabled local account that has a blank password, a common and dangerous misconfiguration.

Ensures the OS drive has a TPM protector and a recovery-password protector, resumes protection if off, and backs the recovery key up to Entra ID. Never prints the recovery key.

Outputs a single-line BitLocker status summary (protection, volume status, encrypted %) for any RMM monitor or condition to capture.

Enables BitLocker encryption on the C: drive.

Turns BitLocker protection on separately from the encryption process (for drives that are encrypted but with protection suspended).

Reports the current BitLocker encryption percentage of a drive.

Backs up the BitLocker recovery key for a drive to Entra ID.

Checks and reports the BitLocker state of the device.

Lists the Intune device-configuration and compliance policies related to BitLocker, and their assignments. Note: relies on the deprecated Microsoft.Graph.Intune SDK and may need reworking for current tenants.

Applies power and sleep settings (for example never sleep on AC power).

Reports the current power and sleep configuration.

Enables Windows automatic updates and sets active hours.

Reports whether automatic updates are running and what active hours are set.

Enables System Restore on the system drive and creates a restore point.

Reports whether System Restore is enabled (not supported on server operating systems).

Removes HP preinstalled bloatware and support applications from a new HP device.