A WPF-based graphical interface for the Microsoft Endpoint Privilege Management (EPM) PowerShell module (
EpmCmdlets.dll). Provides a dark-themed, point-and-click wrapper around the EPM Agent cmdlets — no command line required.
- Windows 10 / 11 with the Microsoft EPM Agent installed via Intune
- EPM policy deployed to the device
- Windows PowerShell 5.1 x64 — the script auto-relaunches under x64 if needed (ARM64 supported)
- Module path:
C:\Program Files\Microsoft EPM Agent\EpmTools\EpmCmdlets.dll
-
Right-click the script → Run with PowerShell, or launch it manually:
powershell.exe -ExecutionPolicy Bypass -STA -File "EpmTools-GUI.ps1"
-
Click ⚡ Load EpmTools Module in the sidebar.
-
Navigate to a cmdlet tab, set parameters, and click Run.
-
Results appear in the Results Grid tab. Use Export CSV or Export JSON to save data.
| Cmdlet | Description |
|---|---|
Get-Policies |
Retrieve ElevationRules or ClientSettings policies from the EPM Agent |
Get-DeclaredConfiguration |
List WinDC documents targeted to this device |
Get-DeclaredConfigurationAnalysis |
Check which MSFTPolicies are processed by the EPM Agent |
Get-ElevationRules |
Look up elevation rules by FileName or CertificatePayload |
Get-ClientSettings |
Display effective client settings used by EPM on this device |
Get-FileAttributes |
Extract publisher and CA certificates from an .exe for rule building |
| Pane | Description |
|---|---|
| 🖥️ Console Log | Timestamped log with INFO / OK / WARN / ERR levels, including verbose output from cmdlets |
| 📄 Raw Output | JSON or formatted text view of the last result |
| 📊 Results Grid | Sortable, scrollable data grid |
CSV and JSON export via Save dialog, available after any successful query.
- The script auto-detects and relaunches under Windows PowerShell x64 if running under PowerShell 7 or a 32-bit process, since
EpmCmdlets.dllis x64-only. Get-FileAttributesauto-discovers the correct parameter names from the loaded cmdlet to handle version differences between EPM Agent releases.- If the module path is missing, the tool shows a clear error pointing to the Intune policy requirement.