Scripts are running on our devices that have been unassigned. How to track them down?

Question

We have checked thoroughly that our test devices are not part of any other groups. We waited time between unassigning the script. We have a few scripts it seems that always show up in our intunepowershell.log that should not be running. It has become important now for us to resolve this nagging issue. Thanks for any suggestions!

Answer 1

@Batman, John , From your description, it seems that our issue is the script is still running on the device after we remove the devices from the assigned group. If there's any misunderstanding, feel free to let us know.

For our issue, we suggest to choose one affected device, Go to Settings->Accounts->Access work or school, and sync policy on our account. Afterwards, restart the affected device and see if the script is still running. Meanwhile, check the device status for this affected device in Intune portal to see if the device record will disappear.

Please try the above steps and if there's any update, feel free to let us know.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you for the suggestions. I have sync'd the computer, fresh started, reimaged a clean 2004 Windows, removed it from Intune and Autopilot by deleting account and hash. It happens on multiple computers as well. Somewhere in our system this script which disables ipv6 in a way we would like to change is still being called to run during enrollment. I was wondering if there was some script I could run to check for all instances of the script in our MEM console. Thanks again, working on this today.

Answer 3

Hi @Batman, John

By any chance is there any powershell script that is assigned to a dynamic group. That's the only possible way a device could get it even after fresh re-enrollment.