Battery Health Overview
Surfaces devices with degraded battery capacity across the entire fleet. Devices below 80% rated capacity are prime replacement candidates.
Community-maintained KQL library for Microsoft Intune Device Query.
Surfaces devices with degraded battery capacity across the entire fleet. Devices below 80% rated capacity are prime replacement candidates.
Shows BIOS version and release date across the fleet. Use this to identify devices running outdated firmware and prioritise BIOS update campaigns before security advisories are issued.
Shows the BitLocker encryption state for all system drives across the fleet. Flags unencrypted or partially encrypted volumes for compliance reporting and remediation.
Finds devices where the system drive has less than 20% free space. Results are ordered by least available space to prioritise the most urgent cases.
Fleet-wide hardware snapshot combining processor and memory data per device. Useful for lifecycle planning and identifying devices below minimum spec thresholds.
Identifies devices with less than 8 GB of physical RAM. These devices are candidates for hardware upgrades or workload redistribution and are most likely to experience performance degradation under modern workloads.
Groups devices by Windows version to show which OS builds are running across the fleet. Useful for patch compliance reporting and feature update planning.
Lists all physical disks across the fleet including size, interface type, and manufacturer. Use this to identify spinning HDD devices that are candidates for SSD migration and to track storage capacity distribution.
Identifies which devices have TPM 2.0 enabled and activated. Essential for Windows 11 readiness assessments and security baseline enforcement.
Lists devices that are missing specific hotfixes from your compliance baseline. Replace the KB IDs in the requiredKBs list with the patches relevant to your organisation.
Lists application crashes captured by Windows Error Reporting. Use this when users report unexpected application closures to quickly identify the crashing process, version, and affected user account.
Reads the Defender protection settings from the registry to confirm real-time protection, antivirus, and antispyware are enabled on the device. A value of 1 means enabled.
Lists all applications installed on the device by reading the Windows registry uninstall keys. Covers both 64-bit and 32-bit software. Useful for software inventory audits and licence reviews.
Lists certificates in the machine store that will expire within the next 365 days. Sorted by soonest expiry first to surface urgent renewals.
Lists all local user accounts on the device including their home directory and Windows SID. Useful for access audits and identifying unexpected or stale local accounts.
Shows all network adapters with their MAC addresses, type, and IPv4 address. Useful for network troubleshooting and asset tracking.
Pulls the 50 most recent Error and Critical events from the System and Application event logs over the past 24 hours. The first stop when diagnosing crashes, driver failures, or application errors.
Shows the 20 processes consuming the most working-set memory on the device. The starting point for diagnosing performance issues and identifying memory leaks.
Lists all programs configured to launch at user login or system startup by reading the Windows Run registry keys. Useful for diagnosing slow boot times and auditing persistence mechanisms.
Lists all in-use Windows drivers that are not digitally signed. Unsigned drivers can indicate malware, tampered binaries, or compatibility issues and should be investigated promptly.
Lists all in-use Windows device drivers for USB, HID, Bluetooth, network, and disk device classes. Useful for USB policy audits and hardware inventory.
Finds Windows services configured to start automatically that are currently stopped. These may indicate crashed or misconfigured services requiring investigation.
No queries match your search.
Try different keywords or clear the filters.
A curated, community-maintained library built for IT pros who need answers fast.
Filter across titles, descriptions, tags, and categories in real time — no page reloads.
Every query is copy-paste ready. Click Copy KQL and paste it straight into Intune Device Query.
Queries are contributed and reviewed by the community. Submit yours via a GitHub pull request.
Browse by category or filter by tag. Find exactly what you need without scrolling through noise.
Queries are labelled for fleet-wide analysis or targeted single-device diagnostics.
Preview queries with KQL syntax colouring before you copy, so you always know what you're running.
No account required. No setup. Just open, search, and copy.
Type a keyword into the search bar or use the category and type filters to narrow the library down to what you need.
Click any card to open the detail view with full KQL syntax highlighting and a description of what the query returns.
Hit Copy KQL, paste the query into Intune Device Query, and run it against your fleet or a single device.
Have a useful query? Open a pull request on GitHub and add it to the community library for everyone to use.
Intune Device Query is a feature in Microsoft Intune Advanced Analytics that lets you run KQL queries against managed devices in real time to retrieve hardware, software, and configuration data without a remote session.
Yes. Device Query requires Microsoft Intune Plan 2 or the Microsoft Intune Suite add-on. Check the official Microsoft docs for the latest licensing requirements.
Multi-device queries run against your entire fleet and return an aggregated result. Single-device queries are targeted at one specific device and are best suited for diagnostics or troubleshooting a particular machine.
Absolutely. The library is open source on GitHub. Fork the repository, add your query to the JSON data file following the existing schema, and open a pull request. All contributions are welcome.
Yes. All queries in this collection are provided free of charge under the project's open-source licence. Copy and adapt them as you need for your environment.