Intune Remediations: Let PowerShell Fix It Before Dave From Accounts Rings

Intune remediations are the closest thing Windows has to a self-cleaning oven. You write one small PowerShell script that checks for a problem and another that fixes it, and Microsoft Intune runs the pair on a schedule until the problem stops coming back.

Without them, the routine is painfully familiar. Dave from accounts rings because his laptop is out of disk space, you remote in and clear out a temp folder stuffed with installers from 2019, and three weeks later he rings again.

This guide covers what Intune remediations are, the licensing and permissions you need, the Intune Management Extension, and my full lab where I clear C:\Temp once it grows past 500MB. It finishes with on-demand runs, logs, a table of other useful examples and a second tested script you can copy.

Never miss a guide: subscribe here and check out my YouTube channel.

Prefer to watch? I build the C:\Temp remediation from scratch in this video:

What are Intune remediations?

Intune remediations (previously called Proactive Remediations) are script packages that find and fix common Windows support issues before anyone raises a ticket. Each package holds a detection script, an optional remediation script and a few settings that control how they run.

Detection script result	What Intune does	How it shows in reports
exit 0	Nothing. The device is healthy	Without issues
exit 1	Runs the remediation script, if the package has one	With issues, then Issue fixed, Recurred or Failed
Any other exit code	The remediation script doesn’t run	Treated as no issue found

That makes Intune remediations good for ongoing hygiene rather than one-off jobs. Platform scripts run once and move on; remediations keep checking, which is handy when Windows, an app or an over-enthusiastic user quietly undoes your work.

Intune remediations prerequisites and licensing

This is where most people get stuck with Intune remediations, usually just after they’ve written a lovely script.

Requirement	Detail
User licence	Windows Enterprise E3 or E5 (included in Microsoft 365 F3, E3 and E5), Windows Education A3 or A5 (included in Microsoft 365 A3 and A5), or Windows Virtual Desktop Access (VDA) per user
Device join type	Microsoft Entra joined or Microsoft Entra hybrid joined
Management	Enrolled in Intune running Windows Enterprise, Pro or Education, or co-managed with Configuration Manager
Agent	Intune Management Extension, which installs itself when a remediation is assigned. Windows in S mode isn’t supported
Tenant setting	Windows license verification turned on (see Step 1)
Admin permissions	Device configurations permissions to create and assign; Remote tasks/Run Remediation for on-demand runs
Package limit	Up to 200 script packages

How to set up Intune remediations in 7 steps

Step 1: Turn on Windows license verification

Before you can create Intune remediations, Intune wants you to confirm you own the right Windows licences. Until then the Create button stays greyed out, which is Intune’s way of asking for your paperwork.

1. Sign in to the Microsoft Intune admin centre as an Intune Administrator.
2. Go to Tenant administration > Connectors and tokens > Windows data.
3. Turn on “I confirm that my tenant owns one of these licenses”, then save.

This is an attestation for the whole tenant. It doesn’t assign licences to anyone, so make sure the statement is true before you flick the switch.

Step 2: Give yourself the right permissions

For the lab I used the Intune Administrator role, which is fine in a test tenant and far too much for day-to-day work. In production, give the people managing Intune remediations an Intune role instead.

Task	Role or permission
Create, edit and assign remediations	Policy and Profile Manager, or a custom role with Device configurations Create, Read, Update, Delete, Assign and View Reports
Run a remediation on demand	Help Desk Operator, School Administrator, or a custom role with Remote tasks/Run Remediation plus Organization/Read and Managed devices/Read
Confirm Windows license verification	Intune Administrator
All of the above	Intune Administrator, ideally eligible through PIM rather than permanent

To assign Intune Administrator, open the Microsoft Entra admin centre, go to Entra ID > Roles & admins, open Intune Administrator, select Add assignments and pick the user. Give it a few minutes, then sign in again. If you use Microsoft Entra PIM, make the assignment eligible.

Step 3: Check the Intune Management Extension is installed

Intune remediations run through the Intune Management Extension (IME), and a device can be fully enrolled without it. The IME installs itself once the user or device is assigned something that needs it, such as a Win32 app, a platform script, a remediation or a custom compliance script.

On the device, open PowerShell and run:

Get-Service IntuneManagementExtension

Status should read Running. If the service is missing, the device hasn’t been assigned anything that needs the IME yet, or it isn’t Microsoft Entra joined.

Step 4: Create a device group

Create a Microsoft Entra security group with assigned membership and add one or two test devices. Device groups suit Intune remediations that run as SYSTEM, which most should. Don’t mix user and device groups across include and exclude assignments.

Step 5: Write the detection and remediation scripts

The lab scenario is simple: if C:\Temp grows beyond 500MB, empty it. It’s a classic dumping ground for installers, exports and the odd ISO someone swore they’d delete.

The detection script measures the folder, writes the size to the output and exits 1 if it’s over the threshold. A missing folder counts as healthy. Save it as Detect-TempOver500MB.ps1:

$Path = 'C:\Temp'
$ThresholdBytes = 500MB

try {
    if (-not (Test-Path $Path)) {
        Write-Output "C:\Temp does not exist"
        exit 0
    }

    $Size = (Get-ChildItem $Path -Recurse -Force -ErrorAction Stop |
        Measure-Object Length -Sum).Sum

    if ($null -eq $Size) { $Size = 0 }

    Write-Output ("C:\Temp size: {0:N2} MB" -f ($Size / 1MB))

    if ($Size -gt $ThresholdBytes) {
        Write-Output "Issue detected: C:\Temp exceeds 500MB"
        exit 1
    }

    exit 0
}
catch {
    Write-Output "Detection error: $($_.Exception.Message)"
    exit 1
}

The remediation script deletes everything inside C:\Temp (the folder itself stays) and exits 0 when it’s done. Save it as Remediate-ClearTemp.ps1:

$Path = 'C:\Temp'

try {
    if (-not (Test-Path $Path)) {
        Write-Output "C:\Temp does not exist"
        exit 0
    }

    Write-Output "Clearing C:\Temp"
    Get-ChildItem $Path -Recurse -Force -ErrorAction Stop |
        Remove-Item -Recurse -Force -ErrorAction Stop

    Write-Output "C:\Temp cleared successfully"
    exit 0
}
catch {
    Write-Output "Remediation error: $($_.Exception.Message)"
    exit 1
}

Step 6: Create the script package in Intune

1. In the Microsoft Intune admin centre, go to Devices > Manage devices > Scripts and remediations.
2. On the Remediations tab, select Create.
3. On Basics, enter a name such as Clear C:\Temp over 500MB and a description. Publisher defaults to your name.
4. On Settings, upload Detect-TempOver500MB.ps1 as the detection script file and Remediate-ClearTemp.ps1 as the remediation script file.
5. Set the three options using the table below, then select Next.
6. Add scope tags if you use them, then select Next.

Setting	My lab	Why
Run this script using the logged-on credentials	No	Runs as SYSTEM, so it can clear the folder whoever is signed in, or with nobody signed in at all
Enforce script signature check	No	Unsigned scripts then run with the Bypass execution policy. Choose Yes only if you sign scripts and the certificate is in Trusted Publishers
Run script in 64-bit PowerShell	Yes	Avoids 32-bit redirection surprises with registry and System32 paths. The default of No would also work for this script

Step 7: Assign and schedule the package

On Assignments, include your test device group, then edit the schedule next to it. There are three options:

Schedule	What it does	Good for
Once	Runs one time at a date and time you choose	One-off checks and clean-ups
Hourly	Runs every n hours, where n is less than 24	Lab testing, or issues that genuinely come back quickly
Daily	Runs at a set time each day, or every few days	Most production remediations

Times follow the device’s local clock unless you tick Use UTC. If a device misses a run because it was switched off, it catches up as soon as it’s back online.

I picked Hourly for the video so I didn’t have to fill the gap with small talk. For real devices, daily or even weekly is kinder to batteries, and nobody needs C:\Temp measured 24 times a day. Select Review + create, then Create.

How to run Intune remediations on demand

Waiting for a schedule is fine until it’s the head teacher’s laptop with the problem. The Run remediation device action fires a script package at a single Windows device straight away.

1. In the Intune admin centre, go to Devices > By platform > Windows and open the device.
2. On the Overview page, select the … menu and choose Run remediation. In my tenant it was labelled Run remediation (preview).
3. Pick the script package. View details shows the scripts and settings before you commit.
4. Select Run remediation.

The package has to exist in Intune but doesn’t need to be assigned to that device. The device must be online and able to reach Intune and the Windows Push Notification Service, and send one Run remediation at a time, because several in quick succession can overwrite each other.

To hurry a scheduled run instead, sync the device from Settings > Accounts > Access work or school > your work account > Info > Sync. That triggers an IME check-in as well as the usual MDM one.

How to prove Intune remediations worked

On the device

Check the folder size from PowerShell:

(Get-ChildItem C:\Temp -Recurse | Measure-Object Length -Sum).Sum / 1MB

After the remediation runs, the answer should be zero or close to it, and my oversized test file, bigfile.bin, should be gone.

In the Intune admin centre

Go back to Devices > Manage devices > Scripts and remediations. The list shows every package with counts for Without issues, With issues, Issue fixed and Recurred.

Open the package to see the Overview, which splits detection status (Without issues, With issues, Failed, Not applicable) from remediation status (Issue fixed, Recurred, Failed). Device status lists each device with its script output, and Export saves the lot to CSV.

For a single device, open it under Devices > By platform > Windows and select Remediations in the Monitor section.

Intune remediations logs and troubleshooting

When the Intune remediations report says nothing useful, the device usually says more. The IME keeps its logs here, and CMTrace reads them far better than Notepad:

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

Log	What to look for
HealthScripts.log	Scheduled remediations: when each package ran and how it finished
AgentExecutor.log	PowerShell script execution details
IntuneManagementExtension.log	Check-ins, policy downloads and reporting
ClientHealth.log	The health of the IME itself

Symptom	Likely cause
Package never runs	Device isn’t in the assigned group, the IME is missing, or the device isn’t Entra joined or hybrid joined
Create is greyed out	Windows license verification isn’t turned on
Detection finds issues but nothing gets fixed	Detection exits with something other than 1, or the package has no remediation script
Status stuck on pending	Device offline, or waiting for the next IME check-in
Works in your console, fails in Intune	The script depends on a user profile, mapped drive or 32-bit versus 64-bit path. Test as SYSTEM with psexec -i -s
Output missing or cut short	Output over 2,048 characters, or the script swallows its own errors

More Intune remediations examples

The C:\Temp clean-up is a gentle start. The best candidates for Intune remediations share three traits: the problem keeps coming back, the fix is predictable and nobody should need to restart.

Problem	Detection checks	Remediation does	Run as
Stopped service	A service set to Automatic isn’t running	Starts it (script below)	SYSTEM
Registry drift	A value no longer matches your standard	Sets it back with Set-ItemProperty	SYSTEM for HKLM, logged-on user for HKCU
Stale Group Policy	Last refresh is more than seven days old	Runs gpupdate (built-in package)	Logged-on user
Office Click-to-Run stopped	The Click-to-Run service isn’t running	Restarts it (built-in package)	Just assign the built-in package
Expired user certificates	Expired certificates from your CA in the user store	Deletes them (Microsoft sample)	Logged-on user
Low disk space	Free space below a threshold	Nothing: a detection-only package that reports it	SYSTEM

That last row is worth remembering. A package can contain only a detection script, which turns Intune remediations into a cheap reporting tool for anything you can measure in PowerShell.

Example: restart the Windows Search service

Here’s a second package you can copy. It checks the Windows Search service (WSearch) and only acts if the service is installed and set to start automatically, so it won’t fight a device where search was disabled on purpose. Save the detection script as Detect-WindowsSearchStopped.ps1:

# Detect-WindowsSearchStopped.ps1
$ServiceName = 'WSearch'

try {
    $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue

    if ($null -eq $Service) {
        Write-Output "$ServiceName is not installed, nothing to do"
        exit 0
    }

    if ($Service.StartType -notlike 'Automatic*') {
        Write-Output "$ServiceName start type is $($Service.StartType), leaving it alone"
        exit 0
    }

    if ($Service.Status -ne 'Running') {
        Write-Output "Issue detected: $ServiceName is $($Service.Status)"
        exit 1
    }

    Write-Output "$ServiceName is running"
    exit 0
}
catch {
    Write-Output "Detection error: $($_.Exception.Message)"
    exit 1
}

And the remediation script as Remediate-StartWindowsSearch.ps1:

# Remediate-StartWindowsSearch.ps1
$ServiceName = 'WSearch'

try {
    Start-Service -Name $ServiceName -ErrorAction Stop
    (Get-Service -Name $ServiceName).WaitForStatus('Running', [TimeSpan]::FromSeconds(30))
    Write-Output "$ServiceName started"
    exit 0
}
catch {
    Write-Output "Remediation error: $($_.Exception.Message)"
    exit 1
}

Run both as SYSTEM. The remediation waits up to 30 seconds for the service and exits 1 if it doesn’t start, so a broken service shows as Failed rather than a cheerful but false Issue fixed. I checked the detection logic against missing, disabled, manual, stopped and running states, and you can swap WSearch for any service name.

Intune remediations gotchas

Locked files. The C:\Temp remediation uses -ErrorAction Stop, so a single file held open by an app stops the clean-up and the run reports Failed. If partial clean-ups are acceptable, switch Remove-Item to -ErrorAction SilentlyContinue and let the next detection judge the result.

Exit codes. Only exit 1 triggers a fix. A detection script that writes output but never exits 1 reports a perfectly healthy estate forever, which is lovely right up until it isn’t.

Software deployment. Intune remediations aren’t an installer. For apps, use Win32 app deployment in Intune instead.

Should you use Intune remediations?

If you have the licences, yes. Intune remediations turn the tickets you fix every week into scripts that fix themselves, and the reports show how often each problem actually happens, which is handy ammunition for the next budget meeting.

Start with one boring, low-risk package like the C:\Temp clean-up. Run it hourly on a test group, read HealthScripts.log, then move it to daily for everyone. For broader disk housekeeping, Storage Sense in Intune may do the job with no scripting, and Endpoint analytics helps you spot which problems deserve a package.

Just don’t let them become a home for every script you’ve ever written. Otherwise you’ve rebuilt C:\Temp, only this time inside Intune, and Windows 98 had better housekeeping than that.

Intune remediations FAQs

Further reading

• Remediations (Microsoft Learn)
• PowerShell scripts for Remediations (Microsoft Learn)
• Intune Management Extension for Windows (Microsoft Learn)
• Device action: run remediation (Microsoft Learn)
• Enable Windows diagnostic data and license verification (Microsoft Learn)
• Configure Storage Sense with Microsoft Intune
• Intune device clean-up rules: hide stale devices
• Update the Secure Boot 2026 certificates with Intune

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.