Intune Powershell Detection Method (what am I missing)

Question

Hello,

We read through the other searched posts and am testing an idea that I came across.

Situation: I am creating an Uninstall Win32 App to remove all instances of APP1 across the environment

The below script (and others I've tested) works as the Win32 App detection method when I upload it initially. We quickly see that it works because add/remove programs uninstalls APP1 successfully.

The issue I need help on: However, if I want to test and re-install APP1 it does not seem to detect it again when rebooting the device or restarting the Microsoft Intune Management Extension. It's possible I am not giving it enough time, but I'm just not sure at this point.

Finally: Do you see any issues with the script I'm using below? What needs to be changed if anything for Endpoint to detect APP1 so it initiates the Uninstall intent?

$app1 = Get-WmiObject -Class Win32_Product -Filter "name like 'app1%' AND vendor like 'microsoft%'" | Select -Expand Version
if ($app1) {
write-output "app1 versions detected, exiting"
exit 0
}
else {

}

Thank you for any assistance or guidance you may be able to provide.

CWT

Answer 1

@CWT

See this for detailed information on different ways to setup and run app detection rules. There's a section on PowerShell tips towards the end.

Intune - Understanding Win32 App Detection Rules
Intune Custom Detection Script

You probably want to examine the IntuneExtensionMnager.log to get a deeper view of what's going on with the detection. In short, if the detection doesn't work reliably every time, there must be some idiosyncrasy with the PowerShell provided (could try taking off the expand version selection and just rely on the presence/absence of the object itself). For instance, perhaps it picks up some leftover information in the registry which leads the app to believe it's still installed. Or the reinstall operation writes something to a different location on disk, which causes it to not be picked up by the same rule.

The only instance where waiting can help is if you're changing detection rules around a lot and want to be more confident it's picking up your latest changes.

Please upvote and accept this thread as answered if it's helpful, thanks!

Answer 2

@CWT , Thanks for posting in Q&A.

For our issue, if we wait some more time like one day, will the app be installed? if not, I think that IME may still consider the app installed. So it didn't install the app. Based as I know, the information of Win32 app detected by IME agent is stored under HKLM\Software\Microsoft\EnterpriseDesktopAppManagement\<SID>\<MSI-ProductCode>. We can delete the related registry key to see if the Win32 app can be installed after restart.

If there's any update, feel free to let us know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Good morning,

Last week I did some testing and believe the end result is positive. The solution in place that seems to be consistently working came down to dropping the else reference shown below.

@KurtBMayer Your suggestion seems to have worked. I spent to much time trying to get different "else" outputs and did not think to just remove it all together, so thank you!

@Crystal-MSFT Thank you for your input as well and one I would have completed if the other option failed, so thank you.

Working Detection Method (for uninstallation):
$app1 = Get-WmiObject -Class Win32_Product -Filter "name like 'app1%' AND vendor like 'microsoft%'" | Select -Expand Version
if ($app1) {
write-output "app1 versions detected, exiting"
exit 0
}

The only remaining question is this. Would you agree that going with PowerShell detection methods is usually best when focusing on just the presence or absence of output? Do you both lean towards the updated script above and only use the "else" approach when something requires it? It does seem like Intune has trouble if the "else" has any output at all which may be the intended use for it (I'm still relatively new). Do you both agree with this statement?

Take care and thank you both again.

CWT