# Prove a remediation detector before allowing its paired fix

> Does the detector reliably identify the issue that authorizes an Intune remediation?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-233-prove-a-remediation-detector-before-allowing-its-paired-fix/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:03+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Does the detector reliably identify the issue that authorizes an Intune remediation?

## Potentially affected

Choose a specific supported-device issue and define the intended healthy state. Confirm the service’s deployment prerequisites and the execution context before assigning the package.

## DSE recommendation

Begin with detection-only observation on a controlled population.

## Article

## Source facts

An Intune Remediations package can contain detection alone or detection with a paired fix. The remediation runs only when detection exits with code 1; other codes do not trigger it. Microsoft requires UTF-8 scripts, without a byte-order mark when signature checking is enabled, and prohibits reboot commands in detection or remediation scripts. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-management/tools/deploy-remediations).

## Applicability

Choose a specific supported-device issue and define the intended healthy state. Confirm the service’s deployment prerequisites and the execution context before assigning the package.

## DSE recommendation

Begin with detection-only observation on a controlled population. Require the author to distinguish a detected issue from a failed observation, such as unavailable input or insufficient permission. Pair the fix only after that distinction is demonstrated. Review the scripts for sensitive data and design a bounded correction that does not embed a restart. Keep any separately needed restart under its own approved workflow.

## Verification

Test a healthy example, a known affected example, and an observation failure. Confirm that only the intended issue produces the trigger and that the paired correction leaves an already-healthy device unchanged. Re-run detection after the approved fix and compare the reported state with the actual setting or behavior. Retain the reviewed script versions and scenario results; an exit code by itself should not be treated as proof that the operational problem was resolved.

## Official references

[Microsoft Learn: Use Remediations to Detect and Fix Support Issues](https://learn.microsoft.com/en-us/intune/device-management/tools/deploy-remediations).

## Primary reference

- Name: Use Remediations to Detect and Fix Support Issues - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-management/tools/deploy-remediations
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Prove a remediation detector before allowing its paired fix,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-233-prove-a-remediation-detector-before-allowing-its-paired-fix/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.