Microsoft Intune PowerShell Detection scripts

When I deploy Win32 packages in Intune, I use PowerShell detection scripts to determine whether the software is installed on a system. In this blog post, I will explain how these scripts work and why they are more flexible than file and registry checks.

What are detection scripts in Intune?

A detection script is a PowerShell script that checks whether an app is present on the client. The app will be detected when the script returns an exit code of 0 and writes a string to STDOUT.

How do detection scripts work?

In the detection script, you check a specific thing on the machine. This could be a Windows service, a printer, multiple files or folders, etc. Because it’s PowerShell, you can check for various system conditions and return the installation status to Intune. (Installed or not installed)

The most important thing is the exit code. The script must exit with an exit code of 0 (Success) or any other exit code (I always use 1 to keep things binary 😉 ). It needs to see an STDOUT message, and I always use Write-Output with a value that tells you what happened during detection. You will see that text in the IntuneManagementExtension.log file, located in the Logs folder at C:\ProgramData\Microsoft\IntuneManagementExtension.

Example detection scripts

Desktop shortcuts

The detection script below will check for shortcuts on the desktops and install them. If a shortcut is not found, it will +1 the badcount. If the badcount is not equal to 0, it will exit with exit code 1 and install the icons (again).

$files = @(
    "C:\users\Public\Desktop\Helpdesk.url"
    "C:\users\Public\Desktop\SAP.url"
    "C:\users\Public\Desktop\YouForce SSO.url"
)

$badcount = 0
foreach ($file in $files) {
    if (Test-Path $file) {
        Write-Output ("{0} was found" -f $file)
    }
    else {
        Write-Output ("{0} was not found" -f $file)
        $badcount++
    }
}

If ($badcount -gt 0) {
    Write-Output ("Not all Desktop Shortcut files were found...")
    exit 1
}
else {
    Write-Output ("All Desktop Shortcut files were found...")
    exit 0
}

Font installation

The script below checks for 10 Open Sans fonts on the client. If there are fewer than 10 OpenSans font files and fewer than 10 registered, it will install the fonts (again).

if ((Get-ChildItem -Path c:\windows\fonts -File opensans*.ttf).count -ge 10 -and ((Get-Item -path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts' | Select-Object -ExpandProperty property | Select-String 'OpenSans-').count -ge 10)) {
       Write-Output 10 OpenSans fonts files and registry items found
       exit 0
}
else {
       Write-Output Not all OpenSans font files and registry items were found
       exit 1
}

Printer installation

The Detection script below checks for the presence of three printers. If not all three printers are found, it will install them (again).

$printers = @(
    'Contoso-General'
    'Contoso-HP'
    'Contoso-MFP'
)

#Check every printer if it's installed
$numberofprintersfound = 0
foreach ($printer in $printers) {
    try {
        Get-Printer -Name $printer -ErrorAction Stop
        $numberofprintersfound++
    }
    catch {
        "Printer $($printer) not found"
    }
}

#If all printers are installed, exit 0
if ($numberofprintersfound -eq $printers.count) {
    Write-Output "($numberofprintersfound) printers were found"
    exit 0
}
else {
    Write-Output "Not all $($printers.count) printers were found"
    exit 1
}

Wi-Fi Profile

The detection script below will check for the presence of a custom Wi-Fi profile and install it (again) when it is not found. In the example below, I changed the customers’ network name to Corporate:

if ((netsh.exe wlan show profiles) -match 'Corporate') {  
    Write-Output Managed Wi-Fi Corporate network found
    exit 0
}
else {
    Write-Output Managed Wi-Fi Corporate network not found
    exit 1
}

Where do I specify a detection script?

When you add a Windows app (Win32) to Intune, you can select it on the Detection Rules tab. In the example below, I chose the detection.ps1 from the OpenSans installation I mentioned above.

Wrapping up

That’s how you use Detection scripts in Intune, and it’s more flexible than the regular File and Registry rules. (And better because PowerShell 😉 )