Deploy PosturIQ device security checks

How it works

The PosturIQ device check is a lightweight script (PowerShell on Windows, Bash on macOS) that checks security settings on each device and reports results to your dashboard. We recommend installing it as a weekly scheduled task so every device re-checks itself automatically and your scores stay current. You can also run it once for a quick spot check.

What it checks

Core security settings on each device, adapted automatically to the platform:

Windows deployment

Option A: Intune (recommended)

Package the installer as a Win32 app and let Intune deploy it silently as SYSTEM to every assigned device. It sets up the weekly scheduled task automatically and can be uninstalled the same way. This is the recommended path for Intune-managed fleets.

1. From the onboarding page, download both PosturIQ-Install.cmd and PosturIQ-Uninstall.cmd. Both come pre-configured with your report token - no editing needed.
2. Put only those two files in an empty folder, then package it with Microsoft's Win32 Content Prep Tool (IntuneWinAppUtil.exe), using PosturIQ-Install.cmd as the setup file. Keep the tool itself outside the folder - the packager bundles everything in the source folder.
3. In Intune, go to Apps > Windows > Add and choose Windows app (Win32). Upload the resulting .intunewin file.
4. On the Program tab set: Install command cmd.exe /c PosturIQ-Install.cmd, Uninstall command cmd.exe /c PosturIQ-Uninstall.cmd, and Install behavior System.
5. On the Detection rules tab add a File rule: path C:\ProgramData\PosturIQ, file PosturIQ-Check.ps1, method File or folder exists.
6. Assign the app to a device group as Required (start with a small pilot group, then widen). To remove it later, move devices to the app's Uninstall assignment.

Simpler alternative: deploy the installer as a Platform Script (Devices > Scripts and remediations > Platform scripts) in the default SYSTEM context. It runs once per device and sets up the same weekly task, but has no built-in uninstall or detection - the Win32 app above is the more complete option.

Option B: RMM deployment (multiple devices)

Push the Install .cmd via your RMM tool and run it as SYSTEM (or any admin account). It runs unattended - no prompts, no flags needed - downloading the check script to C:\ProgramData\PosturIQ\ and creating a weekly scheduled task that runs as SYSTEM.

The scheduled task picks a random weekday per machine to spread reports across the week. (The -Silent flag lives on the check script the task runs, not on the installer.)

Option C: Share link (employees self-service)

No RMM or MDM to push with? Send the share link to employees and have them open the Install tab. The installer requests admin privileges, copies the script to C:\ProgramData\PosturIQ\, and creates a weekly scheduled task running as SYSTEM. In practice this relies on each employee actually running it, so treat it as a fallback for when you can't deploy centrally.

Need a quick one-off instead? The Check tab downloads a .cmd they double-click for a single run - results appear on your dashboard within seconds, but the device won't re-check on its own.

macOS deployment

Option A: RMM / MDM deployment

Push the install script via your RMM and run it as root. No interactive prompts - it works unattended out of the box. This is the recommended path.

Option B: Share link (employees self-service)

No RMM or MDM to push with? Send the share link to employees and have them open the Install tab. The install command pipes through sudo bash and creates a launchd job that runs the check automatically every week. In practice this relies on each employee actually running it, so treat it as a fallback for when you can't deploy centrally.

Need a quick one-off instead? The Check tab gives a curl command they paste into Terminal for a single run - no file download, results appear on your dashboard within seconds, but the device won't re-check on its own.

Uninstall

Windows: Download the uninstaller from the share link (Uninstall tab) and double-click, or run manually:

macOS: Download the uninstaller from the share link, or run manually:

Troubleshooting