One exit code decides whether Intune fixes the problem or does nothing at all.
A remediation package pairs a detection script with a fix script, and the fix fires only when detection returns exit code 1. Add the documented reporting rhythm, where a recurring script stays silent for up to six days when nothing changes, and you have a feature that gets misdiagnosed as broken more often than it actually breaks. We design packages around both rules so your automation earns trust instead of tickets.
- 200Script package ceiling per tenant
- 8 hoursPolicy pickup cadence, unchangeable
- 2,048Character cap on script output
- exit 1The only signal that triggers a fix
Everything hangs on how the detection script exits.
Understand the exit code contract and half of the troubleshooting guides become unnecessary. Miss it and your first package will look inert.
- A package bundles two PowerShell scripts with metadata. The first script tests for the condition. The second corrects it. They communicate through exactly one channel: the exit code of the first.
- Exit code 1 from detection means the condition exists and the remediation should run. Every other outcome, including a script that writes a detailed description of the problem to output but exits 0, tells Intune there is nothing to fix.
- Microsoft draws three bright lines around script content: keep reboot commands out of both scripts, keep passwords and other sensitive values out, and never use the scripts to gather personal data from devices.
- File handling has its own trap. Scripts must be UTF-8, and UTF-8 without a byte order mark wherever signature checking is enforced. Since most editors hide the BOM distinction entirely, uploading a saved file beats pasting text every time.
Eight documented rules that separate reliable automation from surprise outages.
A pair of scripts with a strict contract between them
The package format is detection script plus remediation script plus metadata. Detection answers one question: is the condition present. If it signals yes by exiting with code 1, the remediation executes. Exit zero, any other code, or even empty output all count as condition absent, and the fix stays dormant no matter what the script printed along the way.
Reporting that goes silent on purpose
For recurring scripts, Microsoft documents a seven day cycle: during the first six days the client only sends results when something changed, with the first execution counting as a change, then on day seven it reports unconditionally. A console showing nothing new is usually describing a stable estate, not a stalled one.
An 8 hour retrieval clock you cannot reset
Devices pick up remediation policy at three moments: when the device or the Intune management extension restarts, when a user signs in, and on a fixed 8 hour cycle anchored to when the management extension service started. Signing in again does not move that clock, so a fresh assignment can sit unexecuted for hours without anything being wrong.
Three schedule types and one hard boundary
You can run a package once at a set time, hourly at an interval that must stay under 24 hours, or daily. Execution follows the device's local clock unless you select the Use UTC option, and a device that was offline at its slot runs the package as soon as it reconnects. With staff scattered across US time zones, the local-versus-UTC choice deserves a deliberate answer.
An encoding requirement with no error message
Script files must be UTF-8, and when Enforce script signature check is turned on they must be UTF-8 without a byte order mark. Microsoft's guidance is to upload the file instead of pasting the contents into the browser, because pasting is where the encoding quietly goes wrong and a mis-encoded script simply never behaves.
Signature enforcement swaps the execution policy underneath you
Turn signature checking on and your script is subject to the device's own PowerShell execution policy, Restricted by default on Windows clients and RemoteSigned on Windows Server. Leave it off and scripts execute under Bypass. The built-in packages ship signed, with the signing certificate placed in the device's Trusted Publishers store.
A 2,048 character ceiling and three explicit prohibitions
Output above 2,048 characters is lost, so chatty scripts destroy their own evidence trail. Microsoft also instructs plainly: no reboot commands inside either script, no passwords or other sensitive values, and no collecting personal data from devices. For a HIPAA covered entity or a business subject to a state privacy statute, that third rule is what keeps regulated data out of your admin console.
A single-device trigger for the service desk, still in preview
Run remediation on demand pushes an existing package to one Windows device immediately, provided the caller holds the Run remediation permission under remote tasks and the device can reach Intune and the push notification service. One action per device at a time is the limit; firing several in rapid sequence risks them overwriting each other.
Silence for six days is the documented behavior, not a defect.
Two separate clocks govern this feature, and conflating them is how healthy deployments get torn down and rebuilt for no reason.
- The reporting clock: a run-once script reports when it finishes, but a recurring script reports on change only for six days, counting its first execution as a change, and then unconditionally on the seventh. A device that was fixed on day one contributes nothing new until the weekly report lands.
- What that means in the console: remediated, stable devices drop out of recent results by design. Interpreting that gap as an agent problem, and editing or reassigning the package in response, resets your evidence and teaches the team to distrust a tool that was working.
- The retrieval clock: policy reaches devices on restart of the device or management extension, on user sign-in, and every 8 hours on a schedule pinned to the management extension service start. Sign-ins never shorten the 8 hour interval.
- Put the two clocks together and the minimum honest pilot length writes itself. Allow up to 8 hours for pickup, then a full seven days for the reporting cycle to complete. Judging results on day three means judging a report that has not happened yet.
Four disciplines for code nobody watches while it runs.
Detection accuracy outranks remediation ambition
Since exit code 1 is the sole trigger, a loose detection script does damage in both directions: it can push a fix onto healthy machines or leave broken ones untouched while reporting green. We spend more review time on the detection logic than the fix, because that is where a package earns or loses its credibility.
Pilots run the full seven days, without exception
The documented cycle sends unconditional reports only on day seven, with change-only reporting before that. Evaluating earlier means acting on an incomplete picture, and the usual reaction, rewriting a script that was fine, destroys the baseline you were trying to build. We let the cycle finish before anyone passes judgment.
Every fix is built for its second run
Custom packages repeat every 24 hours and detection fires on whatever schedule you set, so the same remediation will execute against the same machine again. We write fixes that converge on the correct state rather than perform an action, and the documented ban on reboot commands closes off the lazy path for anything restart-shaped.
Files travel by upload, never by clipboard
Microsoft points at browser editing as the way encoding gets corrupted, and the requirement is strict: UTF-8, and BOM-free wherever signature checks apply. A wrong encoding produces no error, no log entry, just a package that never seems to do anything. Uploading a verified file removes that entire failure class.
Four phases over roughly four to five weeks.
- 01Week 1
Qualify the estate, then qualify the problems
Eligibility first: Entra joined or hybrid joined devices, MDM enrolled on Windows Enterprise, Professional or Education, or co-managed, with qualifying licenses confirmed by an Intune Service Administrator before first use. Then the question that determines value: which of your repeat tickets can a script both detect and repair.
- Join state and Windows edition coverage mapped
- License qualification confirmed ahead of first use
- Repeat ticket themes ranked as automation candidates
- The two built-in packages evaluated for early wins
- 02Week 2
Build the scripts against the published rules
Detection returns exit 1 in exactly one circumstance: the condition genuinely present. Remediation is written to run twice without harm, carries no reboot, no credentials and no personal data, and keeps its output inside the 2,048 character ceiling.
- Detection conditions and exit paths reviewed
- Remediation logic proven safe on repeat execution
- Output format designed for the character ceiling
- Files saved UTF-8 and delivered by upload, never paste
- 03Weeks 3-4
Run the pilot long enough to mean something
A controlled device group, a recorded schedule and UTC decision, and then a full seven days untouched, because the reporting cycle only sends unconditional results on day seven. Cutting this short yields data that indicts nothing except the calendar.
- Pilot group assigned and left undisturbed
- Schedule and time zone choices written down
- Full reporting cycle observed end to end
- CSV export pulled and detection accuracy reviewed
- 04Week 5
Go wide and install the maintenance habit
Production assignment, on-demand run permissions issued to the service desk roles that will use them, and a standing review that removes packages once their underlying cause is cured, keeping the tenant well clear of the 200 package ceiling.
- Estate-wide assignment completed
- Service desk permissions for on-demand runs in place
- Retirement review scheduled on a recurring basis
- Operations notes covering both documented clocks
Six recurring problems worth automating away.
Group Policy gone stale on far-flung machines
Microsoft ships Update stale Group Policies as a ready-made package, noting that stale policy shows up at the helpdesk as connectivity and internal resource access complaints. Because it only needs an assignment, it doubles as a safe first exercise for a team getting comfortable with the mechanism.
Office refusing to launch because a service died
The second built-in package restarts the Office Click-to-run service, the failure behind a familiar class of calls where Office applications simply will not open. Both built-ins arrive signed with the certificate in the Trusted Publishers store, so they work even where signature enforcement is on.
A hardening setting that will not stay put
When a legacy application or a user keeps undoing a security configuration, a detect-and-correct package reasserts it on schedule. Frameworks like NIST CSF and SOC 2 would call that a compensating control, and it should be documented as one, but it holds the line while the root cause gets engineered out.
Endpoints where sending a person is the expensive part
Warehouse floors, branch offices, field equipment: the ticket cost is dominated by travel or coordinating remote hands. A package that catches and corrects the routine failure before it surfaces converts the priciest ticket category into a non-event, which is where multi-site US operators see the fastest payback.
Proving a control operated, not just that it existed
Per-device results with CSV export show that a defined condition was evaluated across the estate and corrected wherever found. When a SOC 2 auditor, a HIPAA risk analysis or an FTC Safeguards assessment asks for operating evidence rather than policy text, that export is precisely the artifact they mean.
Giving the service desk a one-click known-good repair
With on-demand runs, an agent can push a vetted package at the caller's machine mid-conversation, in preview, so long as the device is online and reachable through Intune and the notification service. A scripted repair replaces a quarter hour of guided clicking with a single action.
What happens to a repeat endpoint issue in most US companies.
| Feature | Remediations, designed | Ad hoc scripts | Fixed by the service desk |
|---|---|---|---|
Issue corrected before anyone files a ticket | Often | No | No |
Test-for-problem separated from apply-the-fix | Yes | Rarely | Not applicable |
Executes on a defined schedule | Once, hourly or daily | When someone runs it | On a ticket |
Effectiveness visible afterward | Per device status plus CSV export | None | Ticket counts |
Written for repeat execution | By design | Unknown | Not applicable |
Can be fired at one device on request | Yes, in preview | Yes | Yes |
Identical behavior across the estate | Yes | No | No |
Staff time consumed per occurrence | None | Some | A full ticket |
Leaves an audit trail | Yes | No | Partly |
Holds up as the device count grows | Yes | No | No |
The constraint sheet we check every package against.
Constraint
Script packages per tenant
- The rule
- 200 maximum
Constraint
What triggers the remediation script
- The rule
- Detection exiting with code 1, nothing else
Constraint
Every other exit result
- The rule
- Read as condition not found, empty output included
Constraint
File encoding
- The rule
- UTF-8; no byte order mark when signature check is on
Constraint
Script output ceiling
- The rule
- 2,048 characters
Constraint
Hourly interval bound
- The rule
- Under 24 hours, always
Constraint
Custom package repeat rate
- The rule
- Once per 24 hours
Constraint
When devices fetch policy
- The rule
- Restart, user sign-in, and a fixed 8 hour cycle
Constraint
Reboots inside scripts
- The rule
- Prohibited by Microsoft guidance
Constraint
Assignment group hygiene
- The rule
- Never mix user and device groups between include and exclude
Five steps, starting from your service desk history.
- 1
Verify eligibility and licensing
Confirm devices are Entra joined or hybrid joined, MDM enrolled on Windows Enterprise, Professional or Education, or co-managed. Confirm license coverage via Windows Enterprise E3 or E5, Education A3 or A5, or Virtual Desktop Access per user, with an Intune Service Administrator signing off before first use as Microsoft requires.
- 2
Mine the ticket history for candidates
Pull the themes that recur, then filter hard: detectable by script, correctable by script, no restart required. Assigning one of the two built-in packages early proves the pipeline works in your tenant while the custom candidates are still being shortlisted.
- 3
Author and review the packages
Detection that exits 1 solely on a genuine hit. Remediation that is safe to repeat. Output under 2,048 characters, zero reboot commands, zero credentials, zero personal data. UTF-8 files, uploaded rather than pasted, per Microsoft's own recommendation.
- 4
Pilot through one complete reporting cycle
A small device group, the schedule and UTC decision on record, and seven undisturbed days so the unconditional day-seven report arrives. Then the CSV export gets read closely, because inaccurate detection shows up there before it shows up anywhere else.
- 5
Scale out and keep the list honest
Broad assignment, on-demand permissions for the service desk where wanted, and a recurring cull of packages whose underlying problem no longer exists, so the tenant is not creeping toward the 200 package ceiling under the weight of forgotten automation.
The questions US teams bring us about remediations.
Fifteen questions to answer before code ships to every device.
Eligibility
- Entra joined or hybrid joined, confirmed?A hard prerequisite either way.
- Editions covered: Enterprise, Professional, Education?Or co-managed running Windows.
- Licenses in place for the assigned users?Windows E3/E5, Education A3/A5, or VDA per user.
- Licensing signed off by an Intune Service Administrator?Microsoft requires this before first use.
- Package count checked against the ceiling?200 is the tenant maximum.
Script safety
- Detection exits 1 only on a true positive?The sole trigger for remediation.
- Remediation harmless when run twice?Repeat execution is guaranteed.
- Both scripts free of reboot commands?Microsoft prohibits them.
- No passwords, secrets or personal data anywhere?Prohibited, and a compliance exposure besides.
- Output within the 2,048 character ceiling?Everything past it is discarded.
Deployment
- Files uploaded as UTF-8 rather than pasted?The BOM problem hides in pasted text.
- Signature enforcement a conscious choice?It swaps which execution policy applies.
- User and device groups kept apart across include and exclude?Mixing them is explicitly warned against.
- Hourly interval below 24 hours?The documented bound.
- Pilot window spans a full seven days?Shorter windows predate the unconditional report.
The pages around this one.
Intune endpoint analytics
Where the measurement layer lives, alongside the results your remediations feed.
Win32 app packaging
The second surface where your own code runs on managed devices through Intune.
Intune configuration profiles
Declarative settings delivery, worth exhausting before reaching for a script.
Pull ninety days of tickets and rank the repeat offenders.
Any theme a script can detect and correct without a restart is a remediation candidate. The qualifying data is already sitting in your service desk, which makes this the rare automation project that starts with evidence instead of a hunch.
Related Services
Explore more solutions that work great with this service