reverse-engineer-intune

What problem does it solve?

Analyse what Intune actually does on a Windows device by collecting evidence and explaining the real mechanism behind management actions.

Core Features & Use Cases

• Forensics data collection: gathers IME logs, registry hives, MDM certificates, scheduled tasks, services, and management event logs to build a cohesive evidence map.
• Investigation + reporting: synthesizes findings into a Rudy-Ooms-style investigative blog post that clarifies the gap between reported state and actual device behavior.
• Tiered analysis depth: supports Tier 1 read-only collection and can escalate to Tier 2 (Procmon), Tier 3 (IME decompilation), and Tier 4 (native decompilation) as needed.
• Safety-first output: produces a portable markdown deliverable that documents evidence, mechanism, and open questions for lab replication.

Quick Start

Trigger a scenario by saying go rudy this <scenario> and Claude Code will produce the investigative blog post.