Define structured PowerShell checks, run them on a schedule across your devices, surface failing machines.

Checks are named PowerShell scripts that emit a JSON envelope on stdout. The shape is { "passed": bool, "facts": { ... } }. They run across your devices on a schedule (or ad-hoc), results land in a pass/fail matrix, and failed checks above a configured severity fire alerts.

Built-in library

Ten checks ship out of the box covering common security, compliance, and health posture:

Check	Severity	Category
Defender RTP enabled	critical	security
BitLocker enabled on system drive	critical	security
Free disk space > 10%	warning	health
No pending reboot	warning	health
Windows Update lag < 30 days	warning	compliance
OS not end-of-life	critical	compliance
RDP listener disabled	warning	security
No certs expiring within 90 days	warning	compliance
Antivirus signatures fresh (< 7 days)	warning	security
Last scan within 14 days	warning	security

Authoring a check

A check's PowerShell must emit exactly one JSON line on stdout. The last line wins. The shape:

{
  "passed": true,
  "facts": {
    "rtp_enabled": true,
    "last_scan": "2026-05-04T19:32:11Z"
  }
}

A minimal authoring example, building that envelope from Get-MpComputerStatus:

$status = Get-MpComputerStatus
@{
  passed = $status.RealTimeProtectionEnabled
  facts  = @{
    rtp_enabled = $status.RealTimeProtectionEnabled
    last_scan   = $status.QuickScanEndTime
  }
} | ConvertTo-Json -Compress

Run it locally first to confirm the JSON parses:

.\check-defender-rtp.ps1 | ConvertFrom-Json

The facts field is free-form. Put anything you want to surface in the matrix view: timestamps, version strings, counts, hashes. Anything ConvertTo-Json can serialise.

Assigning to devices

Checks can be assigned:

To all devices in the tenant (leave the assignment blank).
To a specific device (per-device override).
To a tag (e.g. all production devices).

Each assignment carries an optional cron schedule (e.g. */5 * * * * for every 5 min).

Failure → alert

When a check returns passed: false and its severity_on_fail is warning or critical, an alert row is written to alert_history and a notification fires. See Fleet troubleshooting & alerts.

Running checks

Built-in library

Authoring a check

Assigning to devices

Failure → alert

See also