Preview-first LOT campaigns
Build manual or automatic Windows 10 LOTs from AD, Intune, or both sources, review evidence before creation, reuse validated read-only caches, and keep the launch decision separate from the preview and selection workflow.
Tool Detail
Smart Intune Windows 11 Upgrade Toolkit
First stable packaged release for preview-first Windows 10 to Windows 11 diagnostics and upgrade campaigns, with autonomous signed endpoint actions, guarded setup upgrades, read-only inventory evidence, and LOT or PsExec orchestration for controlled batches.
Stable public operator package
The public operator package exposes the signed toolkit source, safe templates, and release verification links for controlled Windows 11 readiness and upgrade campaigns. Component versions in this stable package are endpoint 0.1.57, LOT orchestrator 0.1.71, worker 0.1.31, GUI 0.1.51, and automatic LOT engine 1.3.2.
Diagnostics and hardware readiness
Run autonomous signed endpoint checks for Windows 10 or Windows 11 state, setup blockers, pending reboot conditions, storage and policy issues, Windows Update health, and Microsoft hardware-readiness signals before broader upgrade actions.
Guarded setup validation and upgrade
Validate signed setup.exe, readable WIM or ESD media, language matching through lang.ini, and optional setup-media SHA256 manifests before a setup-based upgrade is allowed to continue.
CSV, HTML, and central evidence
Keep run-level CSV history, merged HTML summaries, PsExec logs, central evidence folders, compatibility buckets, and scoped inventory snapshots so support teams can explain why a device was skipped, repaired, or upgraded.
Validated capabilities
Controlled Windows 11 rollout support with conservative operator guardrails
The toolkit supports preview-first LOT workflows from AD and Intune inventory, autonomous endpoint diagnostics, guarded Windows Update repair paths, and setup-based Windows 11 upgrades that require explicit operator intent. Automatic LOT creation preserves evidence CSV files, does not launch the LOT, and keeps read-only root caches separate from per-run outputs.
Setup-based runs validate the Microsoft signature on setup.exe, verify that the install image has a readable WIM or ESD header, check the expected language, and optionally enforce a setup-media SHA256 manifest before continuing. In LOT mode, only the autonomous endpoint script is copied to targets; the target validates and uses the operator-provided setup source itself.
The orchestration layer keeps concurrency limits, technician-side backoff history, run guards, multi-LOT worker gates, and controlled-stop behavior. Reports remain local and reviewable through CSV and HTML outputs, central logs, compatibility evidence, and scoped Intune or AD inventory refreshes.
Intune Win32 helpers
Packaging helpers stay repository-backed and assignment remains manual
The repository includes Intune Win32 packaging helpers for setup media scenarios, cache-only variants, and Graph publication scripts. They are operational helpers for prepared tenants and media sources, not public downloadable deployment artifacts on the website.
Assignments stay operator-controlled and manual. The public page links only to the signed ZIP, the published checksum, the release, and the source tag so tenant-specific rollout choices remain outside the website.
Security and package scope
No Windows media, no public IntuneWin, and no private operating data
The public package does not contain Windows setup media, .intunewin packages, PsExec, operational LOTs, inventories, assignments, logs, reports, tenant identifiers, device names, account details, or local configuration. Operators must obtain PsExec separately from Microsoft Sysinternals and provide properly licensed Windows setup media through their own controlled source.
PowerShell scripts are Authenticode-signed by workplacecloudhub.com. The release ZIP is intended for local review, controlled preparation, and operator-managed campaign execution only.
Expected ZIP SHA-256: 3EF4B0DD0E00954F0CC9874F87A3645F7D790802280E636B098231C007473A26
Quick start
Download, verify, extract, provide PsExec and licensed media, then preview
1. Download the public ZIP package from GitHub Releases.
2. Verify the ZIP against the published SHA-256 file and expected hash 3EF4B0DD0E00954F0CC9874F87A3645F7D790802280E636B098231C007473A26.
3. Extract the complete ZIP to a local folder.
4. Download PsExec separately from Microsoft Sysinternals.
5. Prepare a properly licensed Windows setup source that target devices can reach when setup-based upgrades are required.
6. Run Start-Windows11UpgradeRepair-LotLauncher-GUI.cmd, build a preview-first LOT, review the evidence, and only then launch guarded repair or upgrade actions.
Current source path
GitHub remains the source of truth.
The current GitHub code path is SmartM365/Devices/Windows11UpgradeToolkit. The public release tag is windows11-upgrade-toolkit-v0.1.71, the published source commit is 5a76c7d4f75a6f988ab16c96fc72190c1c67426e, and the repository license is GPL-3.0. View source commit.