Nexthink Recognized by SIIA as the Best Digital Employee Experience Platform Learn more

Learn more

Learn more

cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Intune – Health (classic)

Back

Intune – Health (classic)

Latest Version: 1.0.6.0
|
Updated on July 25, 2024
Install
Configuration

Description

Lack of visibility into device compliance can quickly escalate into devices not receiving vital operational functions. This not only leads to increased issues on employee endpoints, but also puts the wider organization at risk.

The Intune - Health (classic) library pack allows you to track, detect and remediate devices within your landscape that have issues with the health of the installed Intune client.

Key features allow you to:

  • Identify devices that have the Intune client, the ConfigMgr client or are co-managed by both services
  • Detect stability issues related to the Intune clients, including crashes or freezes of any version
  • Monitor Intune clients' performance to ensure devices are not adversely affected
  • Understand the agent deployment in co-management - SCCM and Intune - scenarios
  • Detect and remediate devices that have issues with the health of the installed Intune client

The L1\L2 support teams can use this pack to ensure device compliance and to help fix issues across the landscape

Screenshots

Versions

  • 1.0.6.0 - 25 Jul 2024 - Added 'Get Intune Failed App Deployments' and 'Invoke Intune Failed App remediation'
  • 1.0.5.0 - 17 May 2024 - Added Get Intune compliance status remote action
  • 1.0.4.0 - 10 May 2024 - Appending '(classic)' to pack name
  • 1.0.3.0 - Updated metrics due to remote action changes
  • 1.0.2.0 - Updated Get Microsoft Intune Device Status Remote Action
  • 1.0.1.0 - Updated OS requirements
  • 1.0.0.2 - Screenshots added
  • 1.0.0.1 - Updated configuration url
  • 1.0.0.0 - Initial release

Required Products

Nexthink Act

Platforms

Windows 10 and newer

Compatibility

V6.27 and later

This Might Interest You

CrowdStrike troubleshooting
New

Detect devices impacted by the CrowdStrike global issue and experiencing stability issues to take appropriate action.

Released on July 21, 2024
View Library Pack

Workflow: Chrome update compliance
New

Orchestrate a fully automated Chrome update process.

Released on July 19, 2024
View Library Pack

Get Service Information

Script Description

The script returns the current status and startup type of each service specified in the parameters. Useful for verifying that the status of critical services (e.g. Antivirus, SCCM agent, core business applications, etc.) is in accordance with corporate policies.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Service Name Comma-separated list of services whose status and startup type are requested

Outputs

Label Type Description
Service Information StringList Name, current status, and startup type of the requested service(s)

Further Information

Service names are case-insensitive.

Get Configuration Manager SCCM client status

Script Description

Gets Configuration Manager (SCCM) client services status (SMS Agent, BITS, WMI, etc.) and information about SCCM client on devices.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
SMS Agent Status String Status of the SMS Agent Service
Background Intelligent Transfer Service Status String Status of the Background Intelligent Transfer Service
Windows Management Instrumentation Status String Status of the Windows Management Instrumentation Service
Remote Procedure Call Subsystem Status String Status of the Remote Procedure Call Subsystem Service
Windows Time Service Status String Status of the Windows Time Service
Client Installed Bool If SCCM client is installed or is not
Management Site String Site where the device is connecting to
Last Attempted Communication DateTime Last communication date with server
Last Cumulative Update String Last cumulative update installed on the device
Days Since Last Cumulative Update Int Days since last cumulative update installed on the device
Last Scan DateTime Last scan date
Days Since Last Scan Int Days since last scan
Missing Software Updates Int Number of missing software updates

Test Scenarios

NoMissingUpdates
Test Case There is no missing software updates.
There is data for all fields.
Environment Windows 10 Pro x64
Results Successful - All output fields show the correct data.
MissingData
Test Case There is no data about the last cumulative update.
Environment Windows 10 Pro x64
Results All output fields show the correct data.
LastCumulativeUpdate is empty.
MonthsSinceLastCumulativeUpdate is "01.01.1970 @ 01:00:00".

Set Service Information

Script Description

The script enables the modification of the status and startup type of one or multiple services, which are provided as input. Useful for enforcing the expected status of critical services (e.g. Antivirus, SCCM agent, core business applications, etc.) in accordance with corporate policies.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Service Name The service (or comma-separated list of services) whose status or startup type will be modified. Service names are case-insensitive
Status Change The action (or comma-separated list of actions) to apply to the status of the specified service (or comma-separated list of services)
Set Start Type To The startup type (or comma-separated list of startup types) to apply to the specified service (or comma-separated list of services)

Outputs

Label Type Description
Updated Service Status StringList Name, status, and startup type of the requested service (or list of services) before and after the change

Restrictions

Further Information

Type "" if you do not wish to change either the status or the startup type of a particular service.
Both action names and startup type names are case-insensitive.
Valid actions: Start, Stop, Restart, Pause, Resume.
Valid startup types: Auto, Auto (Delayed Start), Manual, Disabled.
Find the names of the available services in a device by opening the Services tab of the Task Manager (look under the Name column).
Because of the unpredictable behavior of Windows services, note that your changes may be overwritten.

ADVANCED:
This script requires customization by an expert and needs to be thoroughly tested. The potential impact on your environment might also require sign off from the Security Team.
Please, ensure that you don't stop or disable essential Windows services.

Get Intune device status

Script Description

This Remote Action helps organizations to understand the health of their Intune-managed devices, and identify any issues with device enrollment. It is available for use on Windows and macOS Intune onboarded endpoints.

The Remote Action looks for occurrences of a number of errors on the device which would indicate problems and verifies whether the device was onboarded correctly by checking the Microsoft 'Intune MDM' certificate and 'Intune Management Extension' service.

If any issues occur with device enrollment then they will be captured by this Remote Action along with a description of the enrollment error.

Certificate validity checks are also performed, to help you understand if any devices with expired management certificates are present.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
onboarding certificate installed Bool If the certificate 'Microsoft Intune MDM Device CA' used to enroll a device in Microsoft Intune is present on the device or not
onboarding certificate is valid Bool If the certificate 'Microsoft Intune MDM Device CA' is valid (true) or expired (false)
mdm service installed Bool If the service 'Intune Management Extension Status' is present on the device or not
mdm service running Bool If the service 'Intune Management Extension Status' is present and running on the device or not. In case of the service is not present, then the field is left with its default value '-'
device enrollment service installed Bool Checks if the service 'Device Management Enrollment Service' is present on the device or not
enrollment error detected Bool If an Intune device enrollment error is detected, this output will return 'true'
enrollment error message String The error message associated with the enrollment error
enrollment error datetime DateTime The date and time of the recorded enrollment error
auto enrollment error detected Bool This output will be set to 'true' if we detected that an 'auto-enrollment' (such as Autopilot) errored
auto enrollment error message String The error message associated with the auto-enrollment error
auto enrollment error datetime DateTime The date and time of the recorded auto-enrollment error
health checks all passed Bool If any of the outputs is set to 'No' then this defines there is an Intune health problem on the device and this output is set to 'No'

Further Information

For Microsoft Windows only, the Remote Action works by searching on a defined list of event log error events which are known to represent problems occurring on a device which is managed by Microsoft Intune.

Because the 'device management event log' is used as the source of information, note that if this event log is cleared as it becomes full some events may be missed (by default on Windows the log rotation setting for the device management log is set to 1028kb, when it reaches this size the oldest events start to be overwritten).

The more frequently the Remote Action is executed, the less chance there is that errors will be missed.

Get Intune Device Hardware ID

Script Description

Generates a CSV file containing the Hardware ID of the target device, along with the corresponding serial number.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 720 seconds is recommended.

Parameters

Label Description
Network Path UNC path where the Windows Autopilot Hardware ID CSV file will be saved. Example":" \\\\server\\folder
Maximum Delay In Seconds Maximum random delay set to avoid overloading the network. Provide number of seconds less than 600

Outputs

None.

Further Information

This Remote Action is intended to help IT Administrators to obtain the Hardware ID required by Microsoft Autopilot to onboard devices that are part of a migration plan to Microsoft Intune.

If the Remote Action is run in multiple devices at the same time, the CSV files will be generated only per-device in the provided network path.

To merge all the CSV files into a single one that can be easily imported into the Autopilot platform, please consult Nexthink official documentation.

To understand how to configure a network share to work properly with Nexthink Act, please visit this page.

Test Scenarios

HardwareIdCsvIsGenerated
Test Case A correct UNC path is provided
Environment VM Windows 10 x64 EN (1904)
Results Success - The CSV file containing the device serial number and its Hardware ID is generated correctly in the destination network path
HardwareIdCsvIsOverwritten
Test Case A CSV file with the device's hardware data was previously present in the destination network path
Environment VM Windows 10 x64 EN (1904)
Results Success - The CSV file is overwritten with the newly generated Hardware ID in the destination network path
NetworkPathIsUnaccessible
Test Case The network path provided as input parameter is unaccessible from the target device
Environment VM Windows 10 x64 EN (1904)
Results Failure - The CSV file is not generated and the remote action displays an error message about the UNC path being inaccessible

Get Intune compliance status

Script Description

This Remote Action helps you to understand when using devices that are onboarded to Microsoft Intune, whether those devices are at the time of Remote Action execution either marked as Compliant, or Non-Compliant.

When devices are marked as non-compliant by Intune, depending on your M365 / Intune configuration your employees may experience issues accessing certain company resources, therefore it is important to maintain an endpoint environment with devices that are marked as 'Intune compliant'.

For further information on Intune device compliance please refer to Microsoft documentation.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
non compliant Bool If device is not compliant this will be True
last contact time DateTime Time when Intune last contacted device
compliance state description String Description of compliance state
could not retrieve state last 24h Bool Set to True if script is not able to retrieve compliance state within last 24 hours

Further Information

In the event that we detect a device is non-compliant we will provide additional information where possible such as the reason that the device is not compliant.

Invoke Intune failed app remediation

Script Description

In some cases, Microsoft Intune may fail to successfully deploy applications to endpoints. This Remote Action helps you to remediate failed application deployments on endpoint devices.Use this Remote Action in conjunction with 'Get Intune Failed App Deployments' in order to perform a remediation attempt. It can be used to instruct the device to trigger another attempt to reinstall missing applications which are targeted as 'required' assignments for the endpoint. Use Nexthink Flow to build an automated workflow for the best results when using the Remote Actions'Get failed Intune app deployments' and this Remote Action 'Invoke Intune failed app remediation', as the outputs from the former Remote Action are needed as inputs on the latter to achieve the remediation.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Failed app ID The App ID of the failing application which will be scheduled for reinstallation
Failed app GRS The GRS ID of the failing application which will be scheduled for reinstallation

Outputs

Label Type Description
Removed failed ID for app Bool Whether the App ID for the application that failed to install could be set for remediation
Removed failed ID for GRS Bool Whether the GRS ID for the application that failed to install could be set for remediation
ID for app String The application GUID for the failed application deployment
ID for GRS (Global Reevaluation Scheme) String The GRS ID of the application that failed to install, that the Remote Action will remediate

Get Intune Failed App Deployments

Script Description

In some cases, Microsoft Intune may fail to successfully deploy applications to endpoints. This Remote Action helps you to understand when and where application deployments are failing on endpoint devices by outputting values when failures are found.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
failed app deployments Bool Upon inspection of the Intune Management Extension logs we detected the presence of one or more failed application deployments
multiple app failures Bool We detected more than a single app deployment failure
Failed app ID String The application GUID for the failed application deployment
Failed app GRS String The GRS hash value of the failed application which was obtained from the log file or calculated from the AppID
failed app event time DateTime The date and time at which the app failure was detected from the IME log
new app failure detected Bool If a new app failure is detected this flag will be set as true

Further Information

The Remote Action traverses the Intune Management log in order to detect any Intune application deployment failures. If a failure is detected, the corresponding App ID and GRS ID are provided as outputs.

You can then use the corresponding Nexthink Remote Action to fix any detected Intune failed application deployments. Use Nexthink Flow with these Remote Actions to automate the end-to-end process of app deployment remediation.