Prove a remediation detector before allowing its paired fix

Source facts

An Intune Remediations package can contain detection alone or detection with a paired fix. The remediation runs only when detection exits with code 1; other codes do not trigger it. Microsoft requires UTF-8 scripts, without a byte-order mark when signature checking is enabled, and prohibits reboot commands in detection or remediation scripts. Microsoft Learn.

Applicability

Choose a specific supported-device issue and define the intended healthy state. Confirm the service’s deployment prerequisites and the execution context before assigning the package.

DSE recommendation

Begin with detection-only observation on a controlled population. Require the author to distinguish a detected issue from a failed observation, such as unavailable input or insufficient permission. Pair the fix only after that distinction is demonstrated. Review the scripts for sensitive data and design a bounded correction that does not embed a restart. Keep any separately needed restart under its own approved workflow.

Verification

Test a healthy example, a known affected example, and an observation failure. Confirm that only the intended issue produces the trigger and that the paired correction leaves an already-healthy device unchanged. Re-run detection after the approved fix and compare the reported state with the actual setting or behavior. Retain the reviewed script versions and scenario results; an exit code by itself should not be treated as proof that the operational problem was resolved.

Official references

Microsoft Learn: Use Remediations to Detect and Fix Support Issues.