🖥️ Detect Remote Access Tools

Intune Remediation · Reports remote access software other than ScreenConnect

Detection only. No remediation script attached, the output lands in the remediation report.

ScreenConnect and ConnectWise are excluded on purpose so your own agent never reports itself. Add or remove vendors by editing the pattern.

Detection Script

Report installed remote access tools detection

Exits 1 when it finds something, so flagged devices are filterable in the report.

›

# Reports remote access tools other than ScreenConnect.
$names = 'TeamViewer|AnyDesk|LogMeIn|GoToAssist|GoToMyPC|Splashtop|VNC|Atera|NinjaRMM|NinjaOne|Datto|CentraStage|Kaseya|N-able|Take Control|Syncro|Action1|Pulseway|BeyondTrust|Bomgar|Dameware|Remote Utilities|Ammyy|Supremo|RustDesk|Zoho Assist|ISL Light|Parsec|DWAgent|MeshAgent|NetSupport|Radmin|ToDesk|Sunlogin|Chrome Remote Desktop'

$keys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$apps = Get-ItemProperty $keys -ErrorAction SilentlyContinue | Where-Object DisplayName -match $names | Select-Object -ExpandProperty DisplayName
$svcs = Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match $names -or $_.Name -match $names } | Select-Object -ExpandProperty DisplayName

$found = @($apps) + @($svcs) | Sort-Object -Unique

if (-not $found) { Write-Output 'None found.'; exit 0 }

Write-Output ($found -join ' | ')
exit 1

Intune Remediation Settings

Run this script using the logged on credentials No

Enforce script signature check No

Run script in 64-bit PowerShell host Yes

Schedule (recommended) Daily