What eXact collects from a device.

At a glance

Seven tables, 209 top-level columns, and close to 300 further fields inside the structured ones.

Every row carries the device name, the Entra ID device id and the Intune device id. Cross-referencing with Intune and Entra therefore needs no extra key to maintain.

The device: identity, hardware, firmware

Identity

Device name, full DNS name, domain, domain role, domain membership, Entra ID device id, Intune device id and name, SMBIOS UUID, serial number, SMBIOS asset tag, primary user

Model

Manufacturer, model, SKU, chassis type (desktop, laptop, tablet), virtual machine, hypervisor present

Chassis

Manufacturer, serial number, chassis type, physical lock present

Motherboard

Manufacturer, product, serial number, version

Processor

Name, manufacturer, architecture, physical cores, logical cores, base frequency, L3 cache, socket

Firmware

BIOS version, BIOS date, firmware type (UEFI or legacy BIOS)

TPM

Present, enabled, provisioned, ready, endorsement certificate thumbprint

Enrolment

MDM enrolment date, enrolment type, Autopilot profile, Autopilot group tag, ZTD id

Locale

Time zone, country code, keyboard layout, system language

The TPM thumbprint and the settings that require administrator rights are measured: the script runs in system context.

Storage, memory, displays and peripherals

Each group below reports one row per item: a disk, a volume, a memory module, a display.

Physical disks

Number, name, health status, media type (SSD, HDD), capacity, serial number, wear, temperature deviation, corrected and uncorrected read errors, corrected and uncorrected write errors

Volumes

Drive letter, label, file system, size, free space, percentage free, serial number

Memory

Total installed, total slots, slots used; per module: slot, capacity, speed, manufacturer, part number, serial number, form factor, type

Graphics

Name, dedicated memory, driver version and date, video mode, refresh rate

Displays

Manufacturer, model, product code, serial number, year of manufacture, diagonal in inches

Printers and peripherals

Type, name, driver, port, shared, default, network, PnP class, manufacturer, hardware id

Battery

Name, id, design capacity, full charge capacity, wear percentage, cycle count, remaining charge, status

User profiles

Local path, SID, last use, profile loaded, roaming profile configured

Power

Active power plan, page file size

Battery wear comes from the powercfg /batteryreport report, not from an estimate.

Network and Delivery Optimization

Network adapters, one row each

Description, alias, adapter type, link state, link speed, MAC address, network profile name, IPv4 address, subnet mask, default gateway, IPv6 address, DNS servers, DHCP enabled, DHCP server, lease obtained date

Delivery Optimization downloads

Bytes downloaded in total, from the internet, from the local network, from a cache server, over direct HTTP

Delivery Optimization uploads

Bytes uploaded to the internet, to the local network, upload limit reached

Efficiency

Percentage served by peers, by the cache server, over HTTP; foreground and background download rates

Period

Start of the measured month, start date of the cumulative collection

The Delivery Optimization counters are accumulated over the month by the device itself. Windows resets them; the script banks the last value seen before each reset, which avoids the dip on the first of the month. This is the measurement that puts a figure on the WAN bandwidth saved by peer-to-peer caching.

Windows: version, licensing, Office, stability

System

System name, version, build number, revision, architecture, language, installation date

Windows licensing

Licence status, activation channel, last five characters of the key, grace period days remaining, KMS server used

Microsoft 365 Apps

Installed version, update channel, activated product ids

Startup

Last boot, uptime, boot time in milliseconds

Pending restart

Restart required, and why: Windows Update, component servicing, pending file rename

Stability

Last unexpected shutdown, number of unexpected shutdowns over 30 days

Recent crashes, one row per event

Log, event id, type, application, application version, faulting module, date

Features

Hyper-V enabled, WSL enabled, .NET 3.5 enabled, SMBv1 enabled

Windows Update client

Agent version, last successful search, last successful install

SMBv1 enabled and .NET 3.5 enabled are two technical-debt indicators you can put straight on a dashboard.

Applications, patches and drivers

Installed applications

One row per application, from every source: MSI and EXE installations from both registry hives, and Appx packages from the Microsoft Store.

Identification

Name, publisher, version, architecture, language, MSI product code, full Appx package name, winget id

Installation

Install date, location, install source, scope (machine or user), SID of the user concerned, estimated size

Uninstallation

Uninstall command, silent uninstall command, registry key path

Use and staleness

Last used date, version available as an update

The available version comes from winget upgrade run on the device: the gap between installed and available reads directly, with no catalogue to maintain.

Windows patches

One row per patch: KB id, description, install date, and the account that applied it.

Drivers

Drivers, one row each

Device class, name, hardware id, driver provider, manufacturer, version, date, INF file

Devices in error

Name, hardware id, PnP class, manufacturer, Windows error code

Printer drivers are included in the same table.

Browser extensions and certificates

Browser extensions

One row per extension and per user profile, on Microsoft Edge and Google Chrome.

Origin

Browser, user profile concerned

Extension

Id, name, version, enabled or not

Risk

Requested permissions, host permissions, update URL

The update URL tells an extension from the official store apart from one side-loaded from elsewhere.

Certificates

One row per certificate in the machine store.

Identification

Thumbprint, subject, issuer, friendly name, serial number

Validity

Start date, expiry date

Cryptography

Private key present, key size, signature algorithm, self-signed

Use

Enhanced key usages, certificate template name, store and location

A flag marks the certificate that authenticates the inventory itself, with its expiry date: rotation is driven from the same table.

Defences: antivirus, firewall, EDR

Microsoft Defender — state

Operating mode, antivirus enabled, real-time protection, behaviour monitoring, download scanning, network inspection

Microsoft Defender — currency

Signature version, signature date, signature age in days, engine version, product version

Microsoft Defender — scans

Age of the last quick scan, age of the last full scan

Microsoft Defender — hardening

Tamper protection, controlled folder access, network protection, potentially unwanted application protection

Attack surface reduction rules

One row per rule: rule id and applied action (block, audit, disabled)

Defender exclusions

Excluded paths, excluded extensions, excluded processes

Firewall, one row per profile

Profile (domain, private, public), enabled, default inbound action, default outbound action, logging of allowed and blocked connections

Defender for Endpoint

Onboarding state, organisation id, sensor version, sensor running

Third-party antivirus

One row per detected product: type, name, enabled, signatures up to date, raw product state

Defender exclusions are one of the few places where a read without sufficient rights would return text instead of a list. The field is left empty rather than wrong: « not measured » is never confused with « no exclusions ».

Encryption, code integrity and secure boot

BitLocker, one row per volume

Volume type, mount point, capacity, encryption state, percentage encrypted, encryption method, protection status, lock status, auto-unlock, key protectors in detail

Secure boot

Secure Boot enabled on the system side, UEFI CA 2023 certificate on the system and firmware sides

Virtualisation-based security

VBS status, hypervisor-protected code integrity (HVCI), System Guard secure launch, DMA protection, kernel-mode hardware-enforced stack protection

Device Guard and Credential Guard

Security services configured, services actually running, available features, required features, kernel-mode and user-mode code integrity policy enforcement, virtual machine isolation, version

LSA process protection

LSA running as a protected process, state configured at boot

Vulnerable drivers

Vulnerable driver blocklist enabled, effective state

TPM in detail

Owner set, auto-provisioning, lockout counter, lockout reset interval, manufacturer id, specification version

SmartScreen and Smart App Control

SmartScreen in File Explorer, in Edge, in the Microsoft Store, the SmartScreen service, Smart App Control, web content evaluation

Phishing protection

Service enabled, notification on a malicious site, on password reuse, on an unsafe application

Memory mitigations

Data execution prevention, Control Flow Guard, ASLR, image relocation, system mitigation options

BitLocker key protectors are sent as a structured table: the filter « which devices have no key backup » is built on it.

Accounts, privileges and local attack surface

Local accounts, one row each

Name, SID, enabled, built-in administrator account, password required, password expiring, last password change date, last logon, account source

Local administrators

One row per member: name, SID, object class, source (local, Active Directory, Entra ID)

Privileged groups

One row per member: group and its SID, member and its SID, object class, source

Network shares

Name, path, description, type

Sensitive services

Name, display name, state, start mode, run-as account, executable path, reason flagged

Persistence

One row per autostart entry: type, name, path, author, run-as account, command, arguments

Local password policy

Minimum length, maximum age, history kept, lockout threshold

PowerShell hardening

PowerShell version, language mode, script block logging

Legacy protocols

SMBv1 client enabled, LLMNR enabled

Services and persistence entries are filtered on flagging patterns rather than reported wholesale: a device carries several hundred services, almost none of which teach you anything.

Windows Update, LAPS and BIOS settings

Windows Update settings — 39 fields

Service

Windows Update service state, downloading over a metered connection

Group policy

WSUS server and status server, update source for drivers, feature, quality and other updates, dual scan disabled, connections to internet locations blocked, alternative service URL, proxy behaviour, automatic update options, automatic updates disabled, use of the WSUS server

Intune policies — deferral

Feature and quality update deferral in days, branch readiness level (channel), feature and quality update pause, pause start date, feature update uninstall period

Intune policies — deadlines

Deadline for feature and quality updates, grace period, automatic restart forbidden

Intune policies — experience

Active hours start and end, automatic update allowed, Microsoft Update service allowed, drivers excluded from quality updates, preview builds, notification level, scheduled and imminent restart warnings, restart notification dismissal, user access to pause and to the Windows Update interface

LAPS

Managed administrator account name, password backup directory, password age in days, complexity, length, post-authentication actions and their delay.

BIOS settings

Dell, HP and Lenovo, through three separate read paths. The vendor read, the number of settings found, then every firmware setting with its name and value, as the manufacturer names them: secure boot, administrator password, USB boot, virtualisation, TPM, boot port, and whatever else the model exposes.

The number of settings varies by model: several dozen on a recent business device. On Dell, the DellBIOSProvider module has to be deployed — eXact does it as one Intune application. HP and Lenovo need nothing.

Freshness, volume and limits

The script runs as an Intune remediation, in system context, at whatever frequency you set in the portal — typically once a day. There is no agent, no intermediate server and no inbound flow to open: the device writes straight into the organisation's Log Analytics workspace.

Five tables are only re-sent when their contents changed since the last pass: applications, drivers, browser extensions, certificates, patches. A full re-send is forced every seven days, so that no row falls out of the retention window.

Volume, for 10,000 devices

That is roughly 2.3 MB per device per month with everything collected. These figures come from a real capture: one full pass taken on 18 September 2026 from a heavily loaded device — 94 applications, 102 certificates, 12 extensions — weighs 266 KB as compact JSON, of which 46 KB go out on every pass and 220 KB on the full re-send. A lighter device sends less. The cost follows from the ingestion rate of the region and commitment you choose.

Custom extension

A second, separate script feeds an eighth table: registry keys, files and WMI classes of your organisation's choosing. That is the extension point when a specific value is missing — a contract number, a business marker, the version of an in-house application.