Using Intune Registry Inventory for Security Hunting

-



Introduction

Microsoft recently introduced the ability to collect Windows Registry data using Device Inventory and the Properties Catalog in Intune.

While most examples focus on application inventory and configuration validation, I wanted to explore a different use case.

Many security-related events leave traces in the Windows registry. For example, enabling Remote Desktop, configuring a proxy server, or installing remote access software often results in registry changes that can be monitored.

Traditionally, identifying these changes required PowerShell scripts, remote access tools, or dedicated security products.

With Registry Inventory, administrators can collect selected security-related registry values directly from managed devices and review them centrally in Intune. This provides an additional layer of visibility without connecting to the endpoint.

Why This Matters

Security teams are often asked questions such as:

  • Has Remote Desktop been enabled on any devices?
  • Are users configuring proxy servers?
  • Are remote access tools being installed?
  • Which devices no longer match the organization's security baseline?
  • Which devices require further investigation?

Traditionally, answering these questions required:

  • PowerShell scripts
  • Remote support tools
  • Advanced security investigations
  • Manual registry inspections

With Registry Inventory, these checks can be performed directly from Intune.

Building a Lightweight Security Baseline

For this example, I decided to collect a small number of registry values that could indicate security-related configuration changes.

Individually, these values provide useful information. Together, they can help identify devices that no longer match the organization's expected security baseline.

This approach is not intended to replace Microsoft Defender for Endpoint or other dedicated security tools. Instead, it provides an additional layer of visibility using capabilities that many organizations already have available in Intune.

Example Security Signals

Remote Desktop

Registry Path

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

Value

fDenyTSConnections

Example Output

  • fDenyTSConnections = 1 (Remote Desktop disabled)
  • fDenyTSConnections = 0 (Remote Desktop enabled)

This provides a simple way to identify devices where Remote Desktop has been enabled.

Proxy Configuration

Registry Path

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Values

  • ProxyEnable
  • ProxyServer

Example Output

  • ProxyEnable = 1
  • ProxyServer = proxy.company.com:8080

Unexpected proxy settings may indicate configuration drift, troubleshooting changes, or network traffic redirection that should be reviewed.

Remote Access Software

I also tested collecting information from registry locations associated with common remote access tools.

Examples include:

  • HKLM\SOFTWARE\AnyDesk
  • HKLM\SOFTWARE\TeamViewer
  • HKLM\SOFTWARE\RealVNC

The presence of these registry keys may help identify devices running software that is not part of the approved environment.

In many organizations, finding unexpected remote access tools is often one of the quickest ways to identify devices that require additional review.

Creating the Inventory Profile

Navigate to:

Devices → Windows → Configuration → Create → New Policy

Select:

  • Platform: Windows 10 and later
  • Profile: Properties Catalog

Add the following setting:

  • Registry

Configure the registry path for each security signal you want to collect.

For example:

Registry Path

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server

Collection Type

Single Value

Value Name

fDenyTSConnections


Since the collection type is set to Single Value, each registry value must be added on a separate row.

Assign the profile to your devices.

The Microsoft Device Inventory Agent will collect the information and upload it to Intune where it becomes available through Device Inventory.

Security Considerations

While testing Registry Inventory, I found that Microsoft deliberately blocks the collection of sensitive information such as passwords, credentials, secrets, tokens, and certificates.

This provides reassurance that Registry Inventory can be used for operational and security visibility while helping protect sensitive information stored within the registry.

Verifying Results

After deployment, navigate to:

Devices → Windows → Device Name → Monitor → Device Inventory

You can review the collected registry values and compare them with your organization's security baseline.

For example:

  • fDenyTSConnections = 0
  • ProxyEnable = 1
  • ProxyServer = proxy.company.com:8080

These values can help identify devices that may require additional investigation or remediation.

Real-World Benefits

Registry Inventory can help answer questions such as:

  • Which devices have Remote Desktop enabled?
  • Which devices are using proxy servers?
  • Which devices have remote access tools installed?
  • Which devices have drifted from the security baseline?
  • Which devices require additional review?

These checks can be performed without deploying custom scripts or connecting to each endpoint individually.

For organizations managing large numbers of Windows devices, this can significantly reduce investigation time and improve visibility into security-related configuration changes.

Final Thoughts

Registry Inventory is one of the most interesting additions to Intune Device Inventory in recent months.

While many administrators will use it for application inventory and configuration validation, I believe it also has potential as a lightweight security visibility tool.

My testing showed that even a small number of collected registry values can help identify configuration drift, highlight potentially risky changes, and improve visibility into the Windows device estate.

Registry Inventory is not a replacement for Microsoft Defender for Endpoint or dedicated security monitoring platforms. However, it can provide valuable security signals directly within Intune and help administrators identify devices that may warrant further investigation.

As organizations continue to look for simple ways to improve visibility without increasing management overhead, this may prove to be one of the more interesting use cases for Registry Inventory. 🚀


Kommentarer

Skicka en kommentar

Populära inlägg i den här bloggen

🚀 Force Reinstallation of an Intune App

-
Bild
  – When Intune refuses to reinstall a program you’ve already removed Sometimes an application deployed through Microsoft Intune won’t reinstall even after you’ve manually uninstalled it. That’s because Intune tracks installation status using both registry entries and detection rules to decide whether an app is already present. Here’s how to fully reset that state and force a reinstallation — step by step. 💡 Why Intune won’t reinstall the app When a Win32 app is deployed via Intune, the Intune Management Extension stores app metadata in the Windows registry under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps This registry data tells Intune which apps are installed, when, and by which user. On every policy sync, Intune checks the detection rule defined for the app. If the detection rule still reports the app as “installed” — even though you removed it — Intune will skip reinstallation . 🔧 Step-by-Step Guide 1️⃣ Uninstall the App F...
Read more »

🔵Troubleshooting Intune Device Enrollments: Understanding GUIDs, Registry Paths, and EnterpriseMgmt Tasks

-
Bild
This guide explains how to diagnose Intune MDM issues on a Windows device by using two key locations: Task Scheduler → EnterpriseMgmt Registry → HKLM\SOFTWARE\Microsoft\Enrollments These two locations always contain matching GUID folders , and together they show the full state of the device’s MDM enrollment. 📌 Introduction: Why do these GUID folders exist? When a Windows device enrolls into Intune (MDM) , Windows generates a unique GUID folder for that enrollment. That GUID is used in two places: 🔹 1. Task Scheduler Task Scheduler → Microsoft → Windows → EnterpriseMgmt → {GUID} This folder contains scheduled jobs that handle: MDM sync certificate renewal policy retrieval push notification handling 🔹 2. Registry HKLM\SOFTWARE\Microsoft\Enrollments\{GUID} This folder contains detailed information: tenant ID enrollment type certificate thumbprints renewal status MDM server URLs device identity 👉 Both folders describe the same en...
Read more »

🚀 Windows Autopilot Self-Deploying Mode — Zero-Touch Setup That Feels Like Magic

-
Bild
Just imagine this: You unwrap a brand-new PC or reinstall Windows 11 from scratch… and before you even touch the keyboard, the device automatically: ✅ Joins Microsoft Entra ID (Azure AD) ✅ Syncs all Intune apps, settings, and policies ✅ Lands straight on the sign-in screen — ready for the user No technician. No clicks. No wasted time. That’s Windows Autopilot Self-Deploying Mode — effortless, hands-free provisioning that just works. The only prerequisite? Register the device’s Hardware Hash (HWID) in Intune first. Here’s the cleanest 10-minute setup guide to make it happen — perfect for brand-new or freshly reinstalled devices. ⚡ Step-by-Step: Configure Windows Autopilot Self-Deploying Mode in Under 10 Minutes 1️⃣ Start Fresh Use a new PC or perform a clean Windows 11 installation (OOBE stage). 2️⃣ Insert a USB Drive 3️⃣ Identify the Drive Letter Press Shift + F10 , open PowerShell, and run: Get-Volume Find your USB drive letter (e.g., E:). 4️⃣ Run the Script Execute: .\auto...
Read more »