Endpoint Manager - Powershellscript - Fehlersuche

Issue: PowerShell scripts do not run
Possible resolutions:

The PowerShell scripts don't run at every sign in. They run:  

When the script is assigned to a device

If you change the script, upload it, and assign the script to a user or device

 Tip

The Microsoft Intune Management Extension is a service that runs on the device, just like any other service listed in the Services app (services.msc). After a device reboots, this service may also restart, and check for any assigned PowerShell scripts with the Intune service. If the Microsoft Intune Management Extension service is set to Manual, then the service may not restart after the device reboots.

Be sure devices are joined to Azure AD. Devices that are only joined to your workplace or organization (registered in Azure AD) won't receive the scripts.  

Confirm the Intune management extension is downloaded to %ProgramFiles(x86)%\Microsoft Intune Management Extension.

Scripts don't run on Surface Hubs or Windows 10 in S mode.  

Review the logs for any errors. See Intune management extension logs (in this article).

For possible permission issues, be sure the properties of the PowerShell script are set to Run this script using the logged on credentials. Also check that the signed in user has the appropriate permissions to run the script.

To isolate scripting problems, you can:

Review the PowerShell execution configuration on your devices. See the PowerShell execution policy for guidance.

Run a sample script using the Intune management extension. For example, create the C:\Scripts directory, and give everyone full control. Run the following script:

PowerShell

Copy
write-output "Script worked" | out-file c:\Scripts\output.txt  
If it succeeds, output.txt should be created, and should include the "Script worked" text.  

To test script execution without Intune, run the scripts in the System account using the psexec tool locally:

psexec -i -s

If the script reports that it succeeded, but it didn't actually succeed, then it's possible your antivirus service may be sandboxing AgentExecutor. The following script always reports a failure in Intune. As a test, you can use this script:  

PowerShell

Copy
Write-Error -Message "Forced Fail" -Category OperationStopped  
mkdir "c:\temp"   
echo "Forced Fail" | out-file c:\temp\Fail.txt  
If the script reports a success, look at the AgentExecutor.log to confirm the error output. If the script executes, the length should be >2.

To capture the .error and .output files, the following snippet executes the script through AgentExecutor to PowerShell x86 (C:\Windows\SysWOW64\WindowsPowerShell\v1.0). It keeps the logs for your review. Remember, the Intune Management Extension cleans up the logs after the script executes:

PowerShell

Copy
$scriptPath = read-host "Enter the path to the script file to execute"  
$logFolder = read-host "Enter the path to a folder to output the logs to"  
$outputPath = $logFolder+"\output.output"  
$errorPath =  $logFolder+"\error.error"  
$timeoutPath =  $logFolder+"\timeout.timeout"  
$timeoutVal = 60000 
$PSFolder = "C:\Windows\SysWOW64\WindowsPowerShell\v1.0"  
$AgentExec = "C:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe"  
&$AgentExec -powershell  $scriptPath $outputPath $errorPath $timeoutPath $timeoutVal $PSFolder 0 0