{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "slug": "dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script", "url": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/" }, "title": "Test every output channel in an Intune Win32 detection script", "summary": "Why can a Win32 detection script return zero but still report that an application is not installed?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:04+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 232, "potentially_affected": "Review custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.", "dse_recommendation": "Give the detection script a small outcome table covering an installed app, an absent app, and a failed probe.", "primary_source": { "name": "Add and Assign Win32 Apps to Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Intune’s custom Win32 detection script must return exit code zero and write a string to standard output to identify an installed app. Any standard-error output makes the result not installed, even when the other two conditions are met. A nonzero exit code also produces a not-installed result. Intune does not require one particular standard-output string; output presence is the relevant signal. Microsoft Learn.

\n

Applicability

\n

Review custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.

\n

DSE recommendation

\n

Give the detection script a small outcome table covering an installed app, an absent app, and a failed probe. Reserve the positive detection output for a genuinely satisfied test. Review incidental output from helper commands and keep troubleshooting messages from accidentally serving as proof of installation. Preserve the current package and detection logic before changing the production definition.

\n

Verification

\n

Run controlled tests that capture exit code, standard output, and standard error separately. Include zero with no output, zero with positive output, and zero with both output and an error. Then confirm the matching Intune detection result on a pilot device. Compare the result with the actual application state, and retain sanitized channel observations so the next reviewer can explain why each test was accepted or rejected.

\n

Official references

\n

Microsoft Learn: Add and Assign Win32 Apps to Microsoft Intune.

", "content_text": "Source facts\nIntune’s custom Win32 detection script must return exit code zero and write a string to standard output to identify an installed app. Any standard-error output makes the result not installed, even when the other two conditions are met. A nonzero exit code also produces a not-installed result. Intune does not require one particular standard-output string; output presence is the relevant signal. Microsoft Learn.\nApplicability\nReview custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.\nDSE recommendation\nGive the detection script a small outcome table covering an installed app, an absent app, and a failed probe. Reserve the positive detection output for a genuinely satisfied test. Review incidental output from helper commands and keep troubleshooting messages from accidentally serving as proof of installation. Preserve the current package and detection logic before changing the production definition.\nVerification\nRun controlled tests that capture exit code, standard output, and standard error separately. Include zero with no output, zero with positive output, and zero with both output and an error. Then confirm the matching Intune detection result on a pilot device. Compare the result with the actual application state, and retain sanitized channel observations so the next reviewer can explain why each test was accepted or rejected.\nOfficial references\nMicrosoft Learn: Add and Assign Win32 Apps to Microsoft Intune.", "content_markdown": "## Source facts\n\nIntune’s custom Win32 detection script must return exit code zero and write a string to standard output to identify an installed app. Any standard-error output makes the result not installed, even when the other two conditions are met. A nonzero exit code also produces a not-installed result. Intune does not require one particular standard-output string; output presence is the relevant signal. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32).\n\n## Applicability\n\nReview custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.\n\n## DSE recommendation\n\nGive the detection script a small outcome table covering an installed app, an absent app, and a failed probe. Reserve the positive detection output for a genuinely satisfied test. Review incidental output from helper commands and keep troubleshooting messages from accidentally serving as proof of installation. Preserve the current package and detection logic before changing the production definition.\n\n## Verification\n\nRun controlled tests that capture exit code, standard output, and standard error separately. Include zero with no output, zero with positive output, and zero with both output and an error. Then confirm the matching Intune detection result on a pilot device. Compare the result with the actual application state, and retain sanitized channel observations so the next reviewer can explain why each test was accepted or rejected.\n\n## Official references\n\n[Microsoft Learn: Add and Assign Win32 Apps to Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "url": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Test every output channel in an Intune Win32 detection script", "item": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "url": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/", "headline": "Test every output channel in an Intune Win32 detection script", "description": "Why can a Win32 detection script return zero but still report that an application is not installed?", "abstract": "Why can a Win32 detection script return zero but still report that an application is not installed?", "articleBody": "Source facts\nIntune’s custom Win32 detection script must return exit code zero and write a string to standard output to identify an installed app. Any standard-error output makes the result not installed, even when the other two conditions are met. A nonzero exit code also produces a not-installed result. Intune does not require one particular standard-output string; output presence is the relevant signal. Microsoft Learn.\nApplicability\nReview custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.\nDSE recommendation\nGive the detection script a small outcome table covering an installed app, an absent app, and a failed probe. Reserve the positive detection output for a genuinely satisfied test. Review incidental output from helper commands and keep troubleshooting messages from accidentally serving as proof of installation. Preserve the current package and detection logic before changing the production definition.\nVerification\nRun controlled tests that capture exit code, standard output, and standard error separately. Include zero with no output, zero with positive output, and zero with both output and an error. Then confirm the matching Intune detection result on a pilot device. Compare the result with the actual application state, and retain sanitized channel observations so the next reviewer can explain why each test was accepted or rejected.\nOfficial references\nMicrosoft Learn: Add and Assign Win32 Apps to Microsoft Intune.", "datePublished": "2026-09-10T00:28:04+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Test every output channel in an Intune Win32 detection script" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Add and Assign Win32 Apps to Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32" } } ] } }