Intune lets you run PowerShell scripts on Windows devices via the Intune Management Extension (IME). This is one of the most flexible tools in Intune - use it for configuration tasks that have no built-in policy, post-install setup, remediation, or anything that needs scripting. This guide covers the full process from script to execution, including how to check results and handle common issues.
How Intune PowerShell scripts work
When you deploy a PowerShell script via Intune, the Intune Management Extension (IME) agent on the device downloads and runs it. The IME is installed automatically when you deploy a Win32 app or PowerShell script to a device.
Scripts run under one of two contexts:
- SYSTEM - for admin-level tasks like software install, registry changes, service configuration
- Logged-in user - for user-level tasks like setting user preferences, configuring per-user app settings
Prerequisites
- Windows 10 1607 or later (Windows 11 fully supported)
- Device enrolled in Intune and receiving policies
- Intune Management Extension installed on the device (auto-installs with first Win32 app or script assignment)
- Script must be a .ps1 file, max 200KB
Upload and configure the script
- Give the script a clear name and description
- Upload your .ps1 file
- Configure the settings below
- Assign to a device or user group
Script settings explained
Assign and deploy
Assign to Device groups for SYSTEM context scripts. Assign to User groups for user-context scripts. Scripts run within 1 hour of assignment on online devices, or at next check-in.
Monitor execution
Each device shows one of three states:
- Success - script ran and exited 0
- Failed - script ran but exited non-zero, or timed out
- Pending - device has not yet run the script
Reading the IME log
For detailed troubleshooting, read the Intune Management Extension log on the device:
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
Search for your script name in the log to find the execution entry. It shows the script content hash, execution time, exit code, and any errors from the PowerShell engine.
You can also run IME diagnostics from the device by launching the IME tray icon or running:
%ProgramFiles%\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe
Script writing tips for Intune
Always use explicit exit codes
# Good - explicit exit codes
try {
# Your script logic here
Set-ItemProperty -Path "HKLM:\SOFTWARE\MyApp" -Name "Setting" -Value 1
Write-Host "Success"
exit 0
} catch {
Write-Host "Error: $_"
exit 1
}Write a log file for troubleshooting
$logPath = "C:\ProgramData\MyOrg\Scripts\MyScript.log" New-Item -ItemType Directory -Force -Path (Split-Path $logPath) Add-Content $logPath "[$(Get-Date)] Script started" # ... your logic ... Add-Content $logPath "[$(Get-Date)] Script completed successfully"
Check if the script already ran
# Prevent re-running if already applied
$flagPath = "C:\ProgramData\MyOrg\Scripts\myconfig.done"
if (Test-Path $flagPath) { exit 0 }
# ... your logic ...
New-Item $flagPath -Force
exit 0Frequently Asked Questions
Go to Devices > Scripts > Add > Windows 10 and later. Upload your .ps1 file, set Run script in 64-bit PowerShell host to Yes, and assign to a device or user group. The script runs within 1 hour on enrolled devices.
You choose. Set Run this script using the logged on credentials to Yes to run as the current user, or No to run as SYSTEM. Most admin tasks like installing software or changing system settings need SYSTEM context.
Go to Devices > Scripts, select the script, and click Device status. You can see per-device success, failure, or pending status. For detailed output, check the Microsoft Intune Management Extension log at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log.
By default, scripts run once per device. Set Run script in 64-bit PowerShell host and Enforce script signature check as needed. To re-run a script, you must edit it (even a minor change) or reassign it - Intune tracks execution by script hash.