{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "slug": "dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends", "url": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/" }, "title": "Account for cached Intune scripts after Windows management ends", "summary": "Could locally stored Intune scripts still run after a Windows device stops being managed?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:15+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Use this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.", "dse_recommendation": "Review pending script effects with the endpoint owner before ending management.", "primary_source": { "name": "Add PowerShell Scripts to Windows Devices in Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-management/tools/run-powershell-scripts-windows", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft says the Intune Management Extension is not removed immediately when Windows management ends. At its next check-in, usually every eight hours, it detects the unmanaged state and cancels script runs. Locally stored scripts can run in the meantime. If it cannot check in, it retries for up to 24 hours of device-awake time before removing itself. Microsoft Learn.

\n

Applicability

\n

Use this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.

\n

DSE recommendation

\n

Review pending script effects with the endpoint owner before ending management. Distinguish removal of the management relationship from evidence that the local agent has stopped executing work. Coordinate device custody and network availability for the planned handoff. Do not promise immediate cancellation on an offline device or use console record removal as proof that local execution has ceased.

\n

Verification

\n

Rehearse the transition on a nonproduction device with a harmless, observable test script. Record the management change, subsequent check-in or retry evidence, and the agent’s observed state. Check for unexpected script activity during the handoff interval and investigate it before reissuing the device. Preserve timestamps and script identities without retaining secrets or personal data. Close the task only against the agreed local-state evidence, not an assumed wall-clock delay.

\n

Official references

\n

Microsoft Learn: Add PowerShell Scripts to Windows Devices in Microsoft Intune.

", "content_text": "Source facts\nMicrosoft says the Intune Management Extension is not removed immediately when Windows management ends. At its next check-in, usually every eight hours, it detects the unmanaged state and cancels script runs. Locally stored scripts can run in the meantime. If it cannot check in, it retries for up to 24 hours of device-awake time before removing itself. Microsoft Learn.\nApplicability\nUse this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.\nDSE recommendation\nReview pending script effects with the endpoint owner before ending management. Distinguish removal of the management relationship from evidence that the local agent has stopped executing work. Coordinate device custody and network availability for the planned handoff. Do not promise immediate cancellation on an offline device or use console record removal as proof that local execution has ceased.\nVerification\nRehearse the transition on a nonproduction device with a harmless, observable test script. Record the management change, subsequent check-in or retry evidence, and the agent’s observed state. Check for unexpected script activity during the handoff interval and investigate it before reissuing the device. Preserve timestamps and script identities without retaining secrets or personal data. Close the task only against the agreed local-state evidence, not an assumed wall-clock delay.\nOfficial references\nMicrosoft Learn: Add PowerShell Scripts to Windows Devices in Microsoft Intune.", "content_markdown": "## Source facts\n\nMicrosoft says the Intune Management Extension is not removed immediately when Windows management ends. At its next check-in, usually every eight hours, it detects the unmanaged state and cancels script runs. Locally stored scripts can run in the meantime. If it cannot check in, it retries for up to 24 hours of device-awake time before removing itself. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-management/tools/run-powershell-scripts-windows).\n\n## Applicability\n\nUse this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.\n\n## DSE recommendation\n\nReview pending script effects with the endpoint owner before ending management. Distinguish removal of the management relationship from evidence that the local agent has stopped executing work. Coordinate device custody and network availability for the planned handoff. Do not promise immediate cancellation on an offline device or use console record removal as proof that local execution has ceased.\n\n## Verification\n\nRehearse the transition on a nonproduction device with a harmless, observable test script. Record the management change, subsequent check-in or retry evidence, and the agent’s observed state. Check for unexpected script activity during the handoff interval and investigate it before reissuing the device. Preserve timestamps and script identities without retaining secrets or personal data. Close the task only against the agreed local-state evidence, not an assumed wall-clock delay.\n\n## Official references\n\n[Microsoft Learn: Add PowerShell Scripts to Windows Devices in Microsoft Intune](https://learn.microsoft.com/en-us/intune/device-management/tools/run-powershell-scripts-windows)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "url": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for cached Intune scripts after Windows management ends", "item": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "url": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/", "headline": "Account for cached Intune scripts after Windows management ends", "description": "Could locally stored Intune scripts still run after a Windows device stops being managed?", "abstract": "Could locally stored Intune scripts still run after a Windows device stops being managed?", "articleBody": "Source facts\nMicrosoft says the Intune Management Extension is not removed immediately when Windows management ends. At its next check-in, usually every eight hours, it detects the unmanaged state and cancels script runs. Locally stored scripts can run in the meantime. If it cannot check in, it retries for up to 24 hours of device-awake time before removing itself. Microsoft Learn.\nApplicability\nUse this review for a Windows device leaving management while scripts have been assigned. Identify the device’s actual connectivity and assigned script set before choosing the offboarding sequence.\nDSE recommendation\nReview pending script effects with the endpoint owner before ending management. Distinguish removal of the management relationship from evidence that the local agent has stopped executing work. Coordinate device custody and network availability for the planned handoff. Do not promise immediate cancellation on an offline device or use console record removal as proof that local execution has ceased.\nVerification\nRehearse the transition on a nonproduction device with a harmless, observable test script. Record the management change, subsequent check-in or retry evidence, and the agent’s observed state. Check for unexpected script activity during the handoff interval and investigate it before reissuing the device. Preserve timestamps and script identities without retaining secrets or personal data. Close the task only against the agreed local-state evidence, not an assumed wall-clock delay.\nOfficial references\nMicrosoft Learn: Add PowerShell Scripts to Windows Devices in Microsoft Intune.", "datePublished": "2026-09-10T00:26:15+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-341-account-for-cached-intune-scripts-after-windows-management-ends/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for cached Intune scripts after Windows management ends" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Add PowerShell Scripts to Windows Devices in Microsoft Intune - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-management/tools/run-powershell-scripts-windows" } } ] } }