GitHub Repository
A collection of IT/security scripts and configs covering Microsoft 365 deployment, Entra ID (Azure AD) management, Intune, Windows Update troubleshooting, and threat detection.
Repository: Lewis-Barry/Scripts-Stuff
When I have more here, I'll make proper categories.
| Item | Type | Description |
|---|---|---|
| OfficeXML.xml | ODT Config | Office Deployment Tool configuration for installing Microsoft 365 Apps (Monthly Enterprise channel, en-gb) with Access, Publisher, Groove, Lync, and Bing excluded, plus first-run and default save-format settings. |
| OfficeRemoveLangs.xml | ODT Config | Office Deployment Tool configuration for removing a set of installed Office language packs (Spanish, Polish, Arabic, Danish, German, French, Italian, Norwegian, Portuguese, Finnish, Swedish, and Dutch). |
| Intune-GenericAppDetection.ps1 | PowerShell | A reusable Intune Win32 app detection script template that checks the registry uninstall keys for a given application name and returns the appropriate exit code. |
| bulkUpdateEntraIDManagers.ps1 | PowerShell | Bulk-updates the manager field for a list of Entra ID users from a CSV, using Microsoft Graph PowerShell, with a per-user success/failure log. |
| bulkUpdateEntraIDUserAttributes.ps1 | PowerShell | Bulk-updates Entra ID user profile attributes (job title, department, office location, address, etc.) from a CSV, using Microsoft Graph PowerShell. |
| hideDisabledAccountsFromGAL.ps1 | PowerShell | Finds disabled Entra ID user accounts and hides them from the Exchange Online Global Address List, using Microsoft Graph and Exchange Online PowerShell. |
| DetectWUPaths.ps1 | PowerShell (Intune Detection) | Checks a device for specific Windows Update policy and GPCache registry paths, returning an exit code that indicates whether they're present. |
| RemediateWUPaths.ps1 | PowerShell (Intune Remediation) | Companion script to the detection script above; removes the Windows Update policy and GPCache registry paths if found, then restarts the Windows Update service. |
| WindowsUpdateTamper.kql | KQL Query | A Microsoft Defender/Sentinel query that surfaces registry changes to the Windows Update policy key, useful for spotting tampering by third-party tools or legacy Group Policy since Intune/Autopatch doesn't write to that key. |
| Defender_IOC_NAble_CVE_Aug2026.csv | IOC List | A Microsoft Defender custom indicator import file listing IP addresses flagged in N-able's August 2026 security update, set to block with high severity. |