Library Pack Header

Lack of visibility into device compliance can quickly escalate into devices not receiving vital operational functions. This not only leads to increased issues on employee endpoints, but also puts the wider organization at risk.\n\nThe Intune - Health (classic) library pack allows you to track, detect and remediate devices within your landscape that have issues with the health of the installed Intune client.\n\nKey features allow you to:\n* Identify devices that have the Intune client, the ConfigMgr client or are co-managed by both services\n* Detect stability issues related to the Intune clients, including crashes or freezes of any version\n* Monitor Intune clients' performance to ensure devices are not adversely affected\n* Understand the agent deployment in co-management - SCCM and Intune - scenarios\n* Detect and remediate devices that have issues with the health of the installed Intune client\n\nThe L1\\L2 support teams can use this pack to ensure device compliance and to help fix issues across the landscape

Intune - Health (classic)

The script returns the current status and startup type of each service specified in the parameters. Useful for verifying that the status of critical services (e.g. Antivirus, SCCM agent, core business applications, etc.) is in accordance with corporate policies.

Comma-separated list of services whose status and startup type are requested

Service name

Get service information

Name, current status, and startup type of the requested service(s)

Service information

Gets Configuration Manager (SCCM) client services status (SMS Agent, BITS, WMI, etc.) and information about SCCM client on devices.

Get Configuration Manager SCCM client status

SMS agent status

Status of the Background Intelligent Transfer Service

BITS status

Status of the Windows Management Instrumentation Service

WMI status

Status of the Remote Procedure Call Subsystem Service

Remote Procedure Call Subsystem status

Windows Time service status

Client installed

Management site

Last attempted communication

Last cumulative update installed on the device

Last cumulative update

Days since last cumulative update installed on the device

Days since last cumulative update

Last scan

Days since last scan

Missing software updates

The script enables the modification of the status and startup type of one or multiple services, which are provided as input. Useful for enforcing the expected status of critical services (e.g. Antivirus, SCCM agent, core business applications, etc.) in accordance with corporate policies.

The service (or comma-separated list of services) whose status or startup type will be modified. Service names are case-insensitive

The action (or comma-separated list of actions) to apply to the status of the specified service (or comma-separated list of services)

Status change

The startup type (or comma-separated list of startup types) to apply to the specified service (or comma-separated list of services)

Set startup type to

Set service information

Name, status, and startup type of the requested service (or list of services) before and after the change

Updated service status

This Remote Action helps organizations to understand the health of their Intune-managed devices, and identify any issues with device enrollment. Note that the Remote Action supports both Windows and macOS devices. For macOS devices not all outputs are supported, due to differences in the way that the Intune Agent operates on each OS.\n\nThe Remote Action looks for occurrences of a number of errors on the device which would indicate problems and verifies whether the device was onboarded correctly by checking the Microsoft 'Intune MDM' certificate and 'Intune Management Extension' service.\n\nFor Windows devices, If any issues occur with device enrollment then they will be captured by this Remote Action along with a description of the enrollment error.\n\nFor Windows and macOS devices, certificate validity checks are also performed, to help you understand if any devices with expired management certificates are present. The script also outputs for each device the number of days until certificate expiry.\n\nSupported type: Windows, macOS

Get Intune device status

If the certificate 'Microsoft Intune MDM Device CA' used to enroll a device in Microsoft Intune is present on the device or not

Onboarding certificate installed

If the certificate 'Microsoft Intune MDM Device CA' is valid (true) or expired (false)

Onboarding certificate is valid

If the service 'Intune Management Extension Status' is present on the device or not

MDM service installed

If the service 'Intune Management Extension Status' is present and running on the device or not. In case of the service is not present, then the field is left with its default value '-'

MDM service running

Checks if the service 'Device Management Enrollment Service' is present on the device or not

Device enrollment service installed

If an Intune device enrollment error is detected, this output will return 'true'

Enrollment error detected

The error message associated with the enrollment error

Enrollment error message

The date and time of the recorded enrollment error

Enrollment error datetime

This output will be set to 'true' if we detected that an 'auto-enrollment' (such as Autopilot) errored

Auto enrollment error detected

The error message associated with the auto-enrollment error

Auto enrollment error message

The date and time of the recorded auto-enrollment error

Auto enrollment error datetime

If any of the outputs is set to 'No' then this defines there is an Intune health problem on the device and this output is set to 'No'

Health check all passed

This output displays the number of days until Intune management certificate expiry

Days to cert expiry

This output is specifically for macOS and indicates whether or not Company Portal is installed - which must be installed for Intune to operate on macOS

Company portal installed macos

This output is specifically for macOS and indicates whether or not the Intune MDM profile is installed - which must be installed for Intune to operate on macOS

Intune profile installed macos

Generates a CSV file containing the Hardware ID of the target device, along with the corresponding serial number.

UNC path where the Windows Autopilot Hardware ID CSV file will be saved. Example":" \\\\server\\folder

Network path

Maximum random delay set to avoid overloading the network. Provide number of seconds less than 600

Maximum delay in seconds

Get Intune device hardware ID

In environments where devices are managed via Microsoft Intune, ensuring compliance with organizational policies is critical. However, tracking compliance status can be challenging, especially when devices fail to report their status or the Intune Company Portal is not installed.   \n\nThis Remote Action retrieves the compliance status of a device by analyzing cached data from the Intune Company Portal, ensuring up-to-date compliance information is available.\n\nIt provides the Intune compliance status reported in the last 24 hours, helping you troubleshoot issues more effectively.\n\n**Pre-Requisites:**\n\n- Intune Company Portal has to be installed.\n\n**Ideal Target Environment:**\n\n- **Supported Platforms:**\n    - Windows: Windows 10 onwards\n- **Windows Server Compatibility:** No.

Get Intune compliance status

If device is not compliant this will be True

non_compliant

last_contact_time

compliance_state_description

Set to True if script is not able to retrieve compliance state within last 24 hours

could_not_retrieve_state_last_24h

In some cases, Microsoft Intune may fail to successfully deploy applications to endpoints. This Remote Action helps you to remediate failed application deployments on endpoint devices.\nUse this Remote Action in conjunction with 'Get Intune Failed App Deployments' in order to perform a remediation attempt. It can be used to instruct the device to trigger another attempt to \nreinstall missing applications which are targeted as 'required' assignments for the endpoint. Use Nexthink Flow to build an automated workflow for the best results when using the Remote Actions\n'Get failed Intune app deployments' and this Remote Action 'Invoke Intune failed app remediation', as the outputs from the former Remote Action are needed as inputs on the latter to achieve the remediation.

The App ID of the failing application which will be scheduled for reinstallation

Failed app ID

The GRS ID of the failing application which will be scheduled for reinstallation

Failed app GRS

Invoke Intune failed app remediation

Whether the App ID for the application that failed to install could be set for remediation

Removed failed ID for app

Whether the GRS ID for the application that failed to install could be set for remediation

Removed failed ID for GRS

The application GUID for the failed application deployment

ID for app

The GRS ID of the application that failed to install, that the Remote Action will remediate

ID for GRS

In some cases, Microsoft Intune may fail to successfully deploy applications to endpoints. This Remote Action helps you to understand when and where application deployments are failing on endpoint devices by outputting values when failures are found.

Get Intune failed app deployments

Upon inspection of the Intune Management Extension logs we detected the presence of one or more failed application deployments

Failed app deployments

We detected more than a single app deployment failure

Multiple app failures

The GRS hash value of the failed application which was obtained from the log file or calculated from the AppID

The date and time at which the app failure was detected from the IME log

Failed app event time

If a new app failure is detected this flag will be set as true

Intune - Health (classic)

Description

Screenshots

Versions

Content

Required Products

Platforms

Compatibility