# Test every output channel in an Intune Win32 detection script

> Why can a Win32 detection script return zero but still report that an application is not installed?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:04+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why can a Win32 detection script return zero but still report that an application is not installed?

## Potentially affected

Review custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.

## DSE recommendation

Give the detection script a small outcome table covering an installed app, an absent app, and a failed probe.

## Article

## Source facts

Intune’s custom Win32 detection script must return exit code zero and write a string to standard output to identify an installed app. Any standard-error output makes the result not installed, even when the other two conditions are met. A nonzero exit code also produces a not-installed result. Intune does not require one particular standard-output string; output presence is the relevant signal. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32).

## Applicability

Review custom PowerShell detection for an existing Win32 application package. Distinguish its detection script from the installer and any requirement script before applying these return-channel rules.

## DSE recommendation

Give the detection script a small outcome table covering an installed app, an absent app, and a failed probe. Reserve the positive detection output for a genuinely satisfied test. Review incidental output from helper commands and keep troubleshooting messages from accidentally serving as proof of installation. Preserve the current package and detection logic before changing the production definition.

## Verification

Run controlled tests that capture exit code, standard output, and standard error separately. Include zero with no output, zero with positive output, and zero with both output and an error. Then confirm the matching Intune detection result on a pilot device. Compare the result with the actual application state, and retain sanitized channel observations so the next reviewer can explain why each test was accepted or rejected.

## Official references

[Microsoft Learn: Add and Assign Win32 Apps to Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32).

## Primary reference

- Name: Add and Assign Win32 Apps to Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test every output channel in an Intune Win32 detection script,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-232-test-every-output-channel-in-an-intune-win32-detection-script/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.