An end-user device is a computer used directly by an individual rather than primarily as a server. PowerShell remoting is generally a poor fit for these devices because compromise risk, changing network locations, and remote-work connectivity make them difficult to control reliably. section 5.1.3
Manage end-user devices through configuration management or mobile device management (MDM) rather than enabling remote PowerShell execution. Write and test the PowerShell scripts that those systems deploy, while reserving local execution for cases that backend systems or installers cannot handle. section 5.1.3 section 11.4
Apply these operational rules when automating end-user devices:
- Avoid enabling remote PowerShell execution on client devices; it is disabled by default in Windows 10/11 and exposes machines whose locations and networks may be uncontrolled. section 11.4
- Use a systems management solution such as Microsoft Intune, System Center Configuration Manager, Ivanti UEM, ManageEngine Desktop Central, Jamf Pro, Quest KACE, or Symantec Client Management Suite. section 11.4
- Test deployment independently from script writing: management-platform debugging can require an enrolled test machine, an Azure AD join, and a dedicated Azure AD group. section 11.4
Testing a client-device script through Intune
A script intended for Intune cannot be validated only at the PowerShell prompt. Upload it to Intune, deploy it to an enrolled test machine, join that machine to the Azure AD domain, and place it in a test-only Azure AD group before evaluating the deployment. section 11.4
