Disk Cleanup Script
Checks Windows temp folders and recycle bin size. Returns exit code 1 if more than 1GB can be cleaned up.
// QUALITY CHECKS
Validation status
Quality checks
All checks pass- ParsePass
- LintPass
- MetadataPass
- Runbook-readyPass
- Module depsPass
Tests run automatically on every change. What does each check mean?
// REQUIRED PERMISSIONS
Microsoft Graph scopes
DeviceManagementManagedDevices.ReadWrite.AllAllows the app to read and write the properties of devices managed by Microsoft Intune, without a signed-in user. Does not allow high impact operations such as remote wipe and password reset on the device's owner
// CHANGELOG
Version history
Entry · 01
1.1 - Fixed invalid return statement in Get-FolderSize that caused folder sizes to always report 0 bytes
Entry · 02
1.0 - Initial version
// CODE
Source
<#
.TITLE
Disk Cleanup Detection Script
.SYNOPSIS
Detects if system requires disk cleanup based on temp file accumulation
.DESCRIPTION
Checks Windows temp folders and recycle bin size.
Returns exit code 1 if more than 1GB can be cleaned up.
.TAGS
Remediation,Detection
.REMEDIATIONTYPE
Detection
.PAIRSCRIPT
remediate-disk-cleanup.ps1
.PLATFORM
Windows
.MINROLE
Intune Service Administrator
.PERMISSIONS
DeviceManagementManagedDevices.ReadWrite.All
.AUTHOR
Ugur Koc
.VERSION
1.1
.CHANGELOG
1.1 - Fixed invalid return statement in Get-FolderSize that caused folder sizes to always report 0 bytes
1.0 - Initial version
.LASTUPDATE
2026-07-19
.EXAMPLE
.\detect-disk-cleanup-needed.ps1
.NOTES
Runs in SYSTEM context
#>
$ErrorActionPreference = "Stop"
$threshold = 1GB
function Get-FolderSize {
param([string]$Path)
if (Test-Path $Path) {
try {
$size = (Get-ChildItem -Path $Path -Recurse -Force -ErrorAction SilentlyContinue |
Measure-Object -Property Length -Sum).Sum
if ($null -eq $size) { return 0 }
return $size
}
catch { return 0 }
}
return 0
}
try {
$totalSize = 0
# Windows Temp
$totalSize += Get-FolderSize "$env:WINDIR\Temp"
# User Temp folders
Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue | ForEach-Object {
$totalSize += Get-FolderSize "$($_.FullName)\AppData\Local\Temp"
}
# Recycle Bin
try {
$shell = New-Object -ComObject Shell.Application
$shell.NameSpace(0xA).Items() | ForEach-Object {
$totalSize += $_.ExtendedProperty("Size")
}
}
catch {
# Silently continue if unable to access recycle bin
}
Write-Output "Cleanable space: $([math]::Round($totalSize / 1GB, 2)) GB"
if ($totalSize -gt $threshold) {
exit 1
}
exit 0
}
catch {
Write-Error $_
exit 2
}// NOTES
Author notes
Runs in SYSTEM context
// RELATED
Scripts that travel together.
Picked by shared tags, category, and script type — nothing magic, just metadata overlap.
Windows Defender Definition Update
Checks if Windows Defender definitions are current (within 48 hours). Returns exit code 1 if definitions are outdated.
RemediationLocal Admin Drift Script
Enumerates the local Administrators group and compares every member against an allowlist of approved accounts and well-known SIDs (built-in Administrator, the Entra-joined device admin roles, and configurable extra entries). Returns exit code 1 when unauthorized members are present, triggering the paired remediation that removes them. This catches technician accounts, self-elevation leftovers, and helpdesk additions that were never cleaned up.
RemediationOneDrive Known Folder Move Script
Checks the OneDrive policy registry keys for silent Known Folder Move opt-in (KFMSilentOptIn with the tenant ID) and verifies the OneDrive sync client is installed. Returns exit code 1 when the KFM policy is missing or points to a different tenant, triggering the paired remediation that writes the policy keys. Desktop, Documents, and Pictures then move to OneDrive automatically at the next OneDrive sign-in.
Remediation