Rules/INT-005.no-stale-devices.psd1
|
@{ Id = 'INT-005' Title = 'No managed devices without a recent Intune sync' Area = 'ManagedDevices' Severity = 'Medium' References = @( 'https://learn.microsoft.com/intune/intune-service/remote-actions/devices-wipe' ) Rationale = 'A device that has not synced for weeks receives no policy, no compliance evaluation and no remote wipe - it is managed on paper only.' Remediation = 'Investigate the stale devices: retire/wipe decommissioned hardware and fix sync on devices still in use.' Test = { param($Snapshot) $summary = $Snapshot.ManagedDevices.summary $staleCount = [int]$summary.staleCount if ($staleCount -eq 0) { New-TLRuleResult -Status Pass -Evidence ("All {0} managed devices synced within {1} days." -f $summary.total, $Snapshot.ManagedDevices.staleThresholdDays) } else { $examples = @($Snapshot.ManagedDevices.devices | Where-Object { $_._tlStale } | Select-Object -First 10 | ForEach-Object { "$($_.deviceName) (last sync $($_.lastSyncDateTime))" }) New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} managed devices have not synced for over {2} days." -f $staleCount, $summary.total, $Snapshot.ManagedDevices.staleThresholdDays) + $examples) } } } |