INTUNE DEVICE QUERY

Find the right query,
fast.

Community-maintained KQL library for Microsoft Intune Device Query.

22 queries · 10 multi-device · 12 single-device
22 queries
Hardware Multi-Device

Battery Health Overview

Surfaces devices with degraded battery capacity across the entire fleet. Devices below 80% rated capacity are prime replacement candidates.

batteryhardwarehealth +2
Hardware Multi-Device

BIOS / Firmware Versions

Shows BIOS version and release date across the fleet. Use this to identify devices running outdated firmware and prioritise BIOS update campaigns before security advisories are issued.

biosfirmwarehardware +4
Security Multi-Device

BitLocker Encryption Status

Shows the BitLocker encryption state for all system drives across the fleet. Flags unencrypted or partially encrypted volumes for compliance reporting and remediation.

bitlockerencryptionsecurity +3
Storage Multi-Device

Devices with Low Disk Space

Finds devices where the system drive has less than 20% free space. Results are ordered by least available space to prioritise the most urgent cases.

diskstoragespace +3
Hardware Multi-Device

CPU and Memmory Specs Inventory

Fleet-wide hardware snapshot combining processor and memory data per device. Useful for lifecycle planning and identifying devices below minimum spec thresholds.

hardwareinventorycpu +5
Hardware Multi-Device

Devices Below Memory Threshold

Identifies devices with less than 8 GB of physical RAM. These devices are candidates for hardware upgrades or workload redistribution and are most likely to experience performance degradation under modern workloads.

memoryramhardware +4
Operating System Multi-Device

OS Build Version Distribution

Groups devices by Windows version to show which OS builds are running across the fleet. Useful for patch compliance reporting and feature update planning.

oswindowsbuild +4
Hardware Multi-Device

Physical Disk Inventory

Lists all physical disks across the fleet including size, interface type, and manufacturer. Use this to identify spinning HDD devices that are candidates for SSD migration and to track storage capacity distribution.

diskstoragehardware +5
Security Multi-Device

TPM Version Compliance

Identifies which devices have TPM 2.0 enabled and activated. Essential for Windows 11 readiness assessments and security baseline enforcement.

tpmsecuritywindows11 +3
Patching Multi-Device

Missing Critical Windows Updates

Lists devices that are missing specific hotfixes from your compliance baseline. Replace the KB IDs in the requiredKBs list with the patches relevant to your organisation.

patchingupdateskb +4
Diagnostics Single-Device

Recent Application Crash Events

Lists application crashes captured by Windows Error Reporting. Use this when users report unexpected application closures to quickly identify the crashing process, version, and affected user account.

crashesapplicationserrors +4
Security Single-Device

Windows Defender Status

Reads the Defender protection settings from the registry to confirm real-time protection, antivirus, and antispyware are enabled on the device. A value of 1 means enabled.

defenderantivirussecurity +3
Software Single-Device

Installed Applications

Lists all applications installed on the device by reading the Windows registry uninstall keys. Covers both 64-bit and 32-bit software. Useful for software inventory audits and licence reviews.

softwareapplicationsinventory +4
Security Single-Device

Certificates Expiring Within 12 Months

Lists certificates in the machine store that will expire within the next 365 days. Sorted by soonest expiry first to surface urgent renewals.

certificatespkisecurity +4
Security Single-Device

Local User Accounts

Lists all local user accounts on the device including their home directory and Windows SID. Useful for access audits and identifying unexpected or stale local accounts.

usersaccountslocal +4
Network Single-Device

Network Adapters and IP Configuration

Shows all network adapters with their MAC addresses, type, and IPv4 address. Useful for network troubleshooting and asset tracking.

networkadapterip +3
Diagnostics Single-Device

Recent System and Application Errors

Pulls the 50 most recent Error and Critical events from the System and Application event logs over the past 24 hours. The first stop when diagnosing crashes, driver failures, or application errors.

eventserrorslogs +5
Performance Single-Device

Top Processes by Memory Usage

Shows the 20 processes consuming the most working-set memory on the device. The starting point for diagnosing performance issues and identifying memory leaks.

performancememoryprocesses +3
Software Single-Device

Startup Programs

Lists all programs configured to launch at user login or system startup by reading the Windows Run registry keys. Useful for diagnosing slow boot times and auditing persistence mechanisms.

startupautorunboot +4
Security Single-Device

Unsigned or Untrusted Drivers

Lists all in-use Windows drivers that are not digitally signed. Unsigned drivers can indicate malware, tampered binaries, or compatibility issues and should be investigated promptly.

driverssecurityunsigned +4
Hardware Single-Device

Connected USB and PnP Devices

Lists all in-use Windows device drivers for USB, HID, Bluetooth, network, and disk device classes. Useful for USB policy audits and hardware inventory.

usbpnpdevices +6
Diagnostics Single-Device

Stopped Auto-Start Services

Finds Windows services configured to start automatically that are currently stopped. These may indicate crashed or misconfigured services requiring investigation.

serviceswindowsdiagnostics +4

Everything you need for device query

A curated, community-maintained library built for IT pros who need answers fast.

Instant search

Filter across titles, descriptions, tags, and categories in real time — no page reloads.

Ready-to-use KQL

Every query is copy-paste ready. Click Copy KQL and paste it straight into Intune Device Query.

Community-driven

Queries are contributed and reviewed by the community. Submit yours via a GitHub pull request.

Categorised & tagged

Browse by category or filter by tag. Find exactly what you need without scrolling through noise.

Multi- & single-device

Queries are labelled for fleet-wide analysis or targeted single-device diagnostics.

Syntax highlighting

Preview queries with KQL syntax colouring before you copy, so you always know what you're running.

From search to results in seconds

No account required. No setup. Just open, search, and copy.

  1. Search or browse

    Type a keyword into the search bar or use the category and type filters to narrow the library down to what you need.

  2. Preview the query

    Click any card to open the detail view with full KQL syntax highlighting and a description of what the query returns.

  3. Copy and run

    Hit Copy KQL, paste the query into Intune Device Query, and run it against your fleet or a single device.

  4. Contribute back

    Have a useful query? Open a pull request on GitHub and add it to the community library for everyone to use.

Frequently asked questions

What is Intune Device Query?

Intune Device Query is a feature in Microsoft Intune Advanced Analytics that lets you run KQL queries against managed devices in real time to retrieve hardware, software, and configuration data without a remote session.

Do I need a special Intune licence?

Yes. Device Query requires Microsoft Intune Plan 2 or the Microsoft Intune Suite add-on. Check the official Microsoft docs for the latest licensing requirements.

What is the difference between multi-device and single-device queries?

Multi-device queries run against your entire fleet and return an aggregated result. Single-device queries are targeted at one specific device and are best suited for diagnostics or troubleshooting a particular machine.

Can I contribute my own queries?

Absolutely. The library is open source on GitHub. Fork the repository, add your query to the JSON data file following the existing schema, and open a pull request. All contributions are welcome.

Are the queries free to use?

Yes. All queries in this collection are provided free of charge under the project's open-source licence. Copy and adapt them as you need for your environment.