6.3MD-102Advanced
Est: ~15 mins•Verified: 2026-08

Endpoint Analytics & Proactive Remediations

Author and deploy custom PowerShell detection and remediation scripts to proactively detect and fix endpoint configuration drift, performance bottlenecks, and user experience issues.

Tags:#Endpoint Analytics#Remediations#PowerShell#Automation#Intune#MD-102
01

Overview

Intune Proactive Remediations (part of Endpoint Analytics) is a cloud-native automation framework enabling IT organizations to detect and fix common support issues on user endpoints before end users submit helpdesk tickets.

The architecture operates on a strict Detection & Remediation Contract:

  1. Detection Script: A PowerShell script executed by the Intune Management Extension (IME) on a defined schedule (hourly, daily). It evaluates a specific condition (e.g., outdated driver, bad registry key, stopped service, corrupted certificate).
  • If compliant: Outputs a status string and returns exit 0 (Process terminates; no further action taken).
  • If non-compliant: Outputs the issue to STDOUT and returns exit 1 (Triggers the Remediation Script).
  1. Remediation Script: Executes immediately upon receiving an exit 1 signal. It performs corrective actions (starts service, repairs registry, deletes stale cache), and returns exit 0 upon success.
  2. Endpoint Analytics Integration: Telemetry is sent to Microsoft cloud analytics, reporting Startup Performance, Application Reliability, and Work from Anywhere (WFA) health scores.

---

02

When to Use

Administrative TaskConventional MethodProactive Remediation Approach
Restarting Stale Print SpoolerManual Helpdesk ticket / rebootScheduled script detects frozen spooler and restarts service automatically.
Updating Outdated Root CertificatesGroup Policy / Manual installDetection script checks certificate store; remediation imports missing CA cert silently.
Clearing Bloated Teams CacheUser manual instruction stepsScript detects cache > 5 GB, kills Teams process, flushes temp cache safely.
Enforcing Corporate Registry BaselineGPO / Settings CatalogRemediation fixes drift for settings not exposed in standard Intune UI.

---

03

Prerequisites

Licensing Requirements:

  • Windows 10/11 Enterprise, Education, or Virtual Desktop Access (VDA).
  • Microsoft 365 E3/E5, Microsoft 365 Business Premium, or Windows Enterprise E3/E5.
  • Intune Plan 1.

Telemetry & Infrastructure Requirements:

  • Windows Diagnostic Data must be set to at least Required.
  • Intune Management Extension (IME) running on endpoint.
  • Outbound access to *.events.data.microsoft.com.

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Manage devices
        └── Scripts and remediations
            └── Remediations tab
                └── Create script package
                    ├── Detection script file (.ps1)
                    └── Remediation script file (.ps1)

---

05

Step-by-Step Implementation

Step 1: Author the Detection Script (Detect-Spooler.ps1)

PowerShell
# Detection Script: Checks if Print Spooler service is running
$ServiceName = "Spooler"
$Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue

if ($null -eq $Service) {
    Write-Output "Service $ServiceName not found."
    exit 1
}

if ($Service.Status -ne "Running") {
    Write-Output "Service $ServiceName is stopped. Remediation required."
    exit 1
} else {
    Write-Output "Service $ServiceName is running normally."
    exit 0
}

Step 2: Author the Remediation Script (Remediate-Spooler.ps1)

PowerShell
# Remediation Script: Restarts the Print Spooler service
$ServiceName = "Spooler"

try {
    Start-Service -Name $ServiceName -ErrorAction Stop
    Write-Output "Successfully started $ServiceName service."
    exit 0
} catch {
    Write-Error "Failed to start $ServiceName service: $($_.Exception.Message)"
    exit 1
}

Step 3: Create and Deploy the Remediation Package in Intune

  1. In Intune, navigate to Devices > Scripts and remediations > Remediations > Create script package.
  2. Basics: Name: Remediate-PrintSpoolerService.
  3. Settings:
  • Detection script file: Upload Detect-Spooler.ps1.
  • Remediation script file: Upload Remediate-Spooler.ps1.
  • Run this script using the logged-on credentials: No (Runs as NT AUTHORITY\SYSTEM).
  • Enforce script signature check: No (Or Yes if using enterprise code-signing certs).
  • Run script in 64-bit PowerShell: Yes (Recommended to avoid SysWOW64 registry redirection).
  1. Schedule: Set frequency (e.g., Daily at 09:00 AM).
  2. Assignments: Target device group Sec-Devices-Corporate.

---

06

PowerShell Automation

Review Local Remediation Cache on Client PC:

PowerShell
# Inspect Intune Management Extension agent execution logs
$LogPath = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log"
Get-Content -Path $LogPath -Tail 50 | Select-String "Remediation"

Manually Test Detection Script Contract:

PowerShell
# Run detection script in test harness and check $LASTEXITCODE
.\Detect-Spooler.ps1
Write-Host "Script returned exit code: $LASTEXITCODE"
# Output 0 = Compliant | Output 1 = Triggers Remediation

---

07

Microsoft Graph Automation

Create Proactive Remediation Package via Microsoft Graph:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"

$DetectScriptBase64 = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes((Get-Content .\Detect-Spooler.ps1 -Raw)))
$RemediateScriptBase64 = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes((Get-Content .\Remediate-Spooler.ps1 -Raw)))

$Package = @{
    displayName = "Graph-Remediate-PrintSpooler"
    description = "Proactive Remediation deployed via Graph"
    publisher = "IT Infrastructure"
    detectionScriptContent = $DetectScriptBase64
    remediationScriptContent = $RemediateScriptBase64
    runAsAccount = "system"
    runAs32Bit = $false
}

New-MgDeviceManagementDeviceHealthScript -BodyParameter $Package

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Script package status displays Active in Intune console.
Non-compliant test endpoint runs detection script and returns exit 1.
Remediation script executes immediately, repairs condition, and returns exit 0.
Intune console reports status transition from Issue detected to Issue resolved.
Endpoint Analytics dashboard reflects healthy scores under Startup Performance.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
AgentExecutor.logC:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.logRecords PowerShell execution commands, exit codes, and STDOUT/STDERR output.
IntuneManagementExtension.logC:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.logRecords policy sync schedules, signature validation, and payload download hashes.
Registry Execution StateHKLM\SOFTWARE\Microsoft\IntuneManagementExtension\SideCarPolicies\Scripts\ReportsContains local cached JSON reports of script run timestamps and results.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Remediation never triggersDetection script returned exit 0 or threw unhandled exception without proper exit code.Ensure non-compliance explicitly calls exit 1. Do not let scripts terminate with trailing errors.
Script fails with "Signed check failed"Enforce script signature check is enabled, but script is not code-signed.Sign .ps1 file with trusted internal Code Signing certificate or disable signature check.
Registry reads wrong 32-bit hiveScript ran in 32-bit PowerShell engine, accessing SysWOW64\SOFTWARE.Set Run script in 64-bit PowerShell to Yes.

---

11

Production Best Practices

Production Best Practice

Use Descriptive Write-Output Strings:

The first line of output written to Write-Output in your detection and remediation scripts is captured and displayed directly in the Intune console's Pre-remediation detection output and Post-remediation output columns. Keep output concise (under 2048 characters) for clean reporting.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Exit Code Contract: Memorize: exit 0 = Healthy / Compliant; exit 1 = Problem found / Trigger Remediation.
  2. 64-bit vs 32-bit: By default, Intune executes PowerShell scripts in 32-bit context unless you explicitly toggle Run script in 64-bit PowerShell to Yes.
  3. License Requirement: Proactive Remediations requires Windows Enterprise, Education, or VDA licenses. It is not supported on Windows Pro stand-alone licenses.

---

13

Official Documentation

PREVIOUS TOPIC6.2 Intune Management Extension (IME) Log DiagnosticsNEXT TOPIC6.4 Device Lifecycle: Remote Actions & Recovery