How to Generate Reports Showing Device Owner to Device Mismatch in Client Environments You can’t secure what you can't accurately identify, and reassigned or shared laptops are a major source of endpoint vulnerability. Every device owner mismatch in your environment represents a breakdown in your security perimeter, and a potential gap in your incident response plan. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this Identifying the Current Device User via PowerShell To start, you need to know who is actually sitting at the keyboard. Use PowerShell to query the LogonUI registry key to pull the SID and username of the last person to access the endpoint. For a more detailed look at recent device usage, you can also query the Win32_UserProfile class and sort profiles by LastUseTime to identify the most recently active user profile. Retrieving Expected Ownership Data from Graph API Next, you need a trusted source to compare against. By connecting to the Microsoft Graph, you can retrieve user-device mappings directly from Microsoft Intune. This allows you to programmatically retrieve the UserPrincipalName associated with a managed device, helping establish who is expected to use that endpoint according to your central management records. Comparing Data to Identify a Device Owner Mismatch With both data points in hand, use a simple if-else script to compare the actual user against the expected owner. If they don't match, the script generates a custom report object that flags the device owner mismatch for further review. You can then export these findings to a CSV file, giving you an immediate, actionable list that require technician review or reassignment. Automating Audit Logs and RMM Integration Manual checks don't scale, so you must integrate these scripts into your existing management framework for continuous oversight. Registry Logging: Save your audit results to a custom registry path to create a local record of ownership status and mismatch findings. Scheduled Execution: Use Task Scheduler or your RMM platform to run audit scripts regularly and keep ownership data current. RMM Power: Leverage an RMM platform to deploy these checks across your entire fleet simultaneously. Proactive Alerts: Configure automated notifications and ticketing workflows to help technicians respond to ownership mismatches quickly. Every hour your team spends manually verifying device ownership is time taken away from higher-value IT initiatives. Automating ownership mismatch reporting not only improves visibility and security posture, but also reduces administrative overhead for IT teams. Streamline your workflow, secure your endpoints, and let automation do the heavy lifting. For more information, check out our official blog post on How to Generate Reports Showing Device Owner to Device Mismatch in Client Environments linked in the description below.