Skip to main content
The TruU PowerShell module lets administrators query a Windows device for TruU information from PowerShell. Use it to check which TruU product is installed, its version, and which users are enrolled, so your scripts can make decisions based on the device’s TruU state. For example, you can use it in an Intune remediation, an SCCM compliance check, or an inventory report.

​
What’s included

The module ships with the TruU installer for both TruU Windows Authenticator and Frontline Access. You don’t need to download or enable anything separately.
Details
Install locationC:\Program Files\WindowsPowerShell\Modules\TruU
ScopeAll users (system level). Any account on the device can use it, including the SYSTEM account that Intune and SCCM run as.
PowerShell versionsWindows PowerShell 5.1 (built into Windows 10 and 11) and PowerShell 7
Architecturesx64 and ARM64
Updates and removalThe module updates when you upgrade TruU and is removed when you uninstall TruU.

​
Available commands

All commands use the truu alias, which is the same for both products.
CommandDescriptionWindows Authenticator
truu -helpLists the available commands.Yes
truu -versionShows the installed TruU product version.Yes
truu -producttypeShows which TruU Windows Authenticator in us smartcard or FIDO2Yes
truu -enrollmentsLists the users enrolled on the device.Yes

​
Enrollment details

On Windows Authenticator, truu -enrollments returns the following for each enrolled user:
  • User principal name (UPN)
  • Enrollment date
  • Authentication type: Smartcard or FIDO2
  • Whether face is enrolled
  • Whether fingerprint is enrolled
If no users are enrolled on the device, the command reports that there are no enrollments.

​
Use the module

1

Open PowerShell

Open Windows PowerShell 5.1 or PowerShell 7 on a device where TruU is installed. The module loads automatically, so you don’t need to run Import-Module.
2

Confirm the module is available

Run the help command to list the commands available for the installed product.
3

Run the commands you need

​
Use the module in management scripts

Because the module is installed for all users, scripts that Intune or SCCM run as SYSTEM can call it directly. Check that the module is present before you call it, so the script handles devices where TruU isn’t installed.
Before you build logic that parses command output, such as checking for enrolled users, run the commands on a test device to confirm the exact output for your TruU version.

​
Notes

Users who enrolled before their device was upgraded to a TruU version that includes the module may show an unknown enrollment date or biometric status. Re-enrolling the user updates these values.
Install TruU Windows Authenticator manually Windows Authenticator Uninstallation