Intune remediation scripts fail before the fix even runs

The easiest way to misread an Intune remediation is to focus on the remediation script. In practice, the detection script decides whether the fix gets a chance to run. Microsoft’s current Remediations documentation states that the remediation script runs only when detection returns exit 1.

The contract that matters

A detection script should answer one narrow question: is the device currently compliant with the state this package owns? Keep its result deterministic and use exit codes consistently.

$path = "HKLM:\SOFTWARE\Contoso\DeviceState"
$value = Get-ItemPropertyValue -Path $path -Name "Configured" -ErrorAction SilentlyContinue

if ($value -eq 1) {
    Write-Output "Compliant"
    exit 0
}

Write-Output "Configuration missing"
exit 1

In this pattern, 0 means no remediation is required and 1 means the issue was detected, allowing remediation to run. Any other exit code prevents the remediation script from running. Avoid using exceptions as ordinary control flow; they make reporting harder to interpret.

Microsoft also documents a 2,048-character output limit and requires scripts to be UTF-8 encoded. If signature enforcement is enabled, the file should be UTF-8 without a byte order mark.

Keep detection read-only

Detection should not quietly repair the state it is measuring. If the script changes the device and then returns compliant, reporting can hide the actual remediation path and make failures difficult to reproduce.

Verify before production

This note is not lab-tested. Test at least four paths before broad assignment:

1. A compliant device returns 0 and does not run remediation.
2. A non-compliant device returns 1 and runs remediation.
3. A detection error is visible and does not look like compliance.
4. A second run after remediation returns 0.

Scheduling also needs tenant-aware verification. Microsoft says assignments can run once, hourly, or daily; missed runs occur when the device next comes online, and recurring client reporting has its own seven-day cycle.