Search for a command to run...
Get the local client's Win32App deployment data
I work as System Administrator for more than 15 years now and I love to make my life easier by automating work & personal stuff via PowerShell (even silly things like food recipes list generation).
No comments yet. Be the first to comment.
Or any other Azure service requiring special authentication strength
If you are using Azure Local (HCI), you might find the following PowerShell script AzureLocalVMImageUpdater.ps1 useful. What is it good for? The code replaces the Windows VM images in the specified Azure Local cluster(s) with the latest compatible ve...
Problem It happens that the hardware hash of your Autopilot device gets changed. Thanks to the replacement of the motherboard or some other issue. This can lead to future problems when your users need to reinstall the operating system, but the Autopi...
Learn how to use undocumented Azure APIs for massive performance gains
Keeping a secure, version-controlled backup of your Intune-managed device data, including BitLocker, LAPS, and FileVault keys, is a best practice for any modern IT team. In this post, I’ll guide you through an Azure DevOps pipeline that automates the...
28.9.2022 I've rename the function Get-IntuneWin32App to Get-IntuneWin32AppLocally to emphasize that data are gathered locally and to avoid naming conflicts
If you've ever deployed Win32App through Intune and had some issues with it, you were probably missing some tool that would show you the app deployment status retrieved directly from the local client's data.
Why? Because you probably needed answers to some of these questions:
Today I will show you my solution to these questions and hopefully make your day 🙂.
Install IntuneStuff module from PowerShell Gallery and run the Get-IntuneWin32AppLocally function like this 👇
Install-Module IntuneStuff -Force
# show Win32App data (source will be client Intune log file combined with registry data)
Get-IntuneWin32AppLocally
# show Win32App data (source will be just client Intune log file)
Get-IntuneLogWin32AppData
Get-IntuneLogWin32AppReportingResultData
And you will get results like this 👇
Or you can pipe the results to Out-GridView to show them in the GUI 👇
Some data can get truncated when using
Out-GridView!
The IntuneManagementExtension.log (C:\ProgramData\Microsoft\IntuneManagementExtension\Logs) contains all relevant data about the processing of Win32Apps. But it can be a little bit hard to find the right information in it. For example processing of Win32Apps is stored in one super long line that looks like this 👇
This line contains multiple JSONs (one for each app) with details like App Id, Name, Compliance state, Detection and Requirement rules, etc. Helper function Get-IntuneLogWin32AppData extracts this data and converts them into a PS object using small regex magic and Convert-FromJson cmdlet.
Mentioned JSON contains also ScriptBody property with base64 encoded detection/remediation PS script which can be (and is) easily converted into original PowerShell code.
Last but not least most of the number codes are being translated into corresponding text messages. Unfortunately, I wasn't able to find all relevant data so some codes remain intact.
TIP: for Windows errors code translation I use:
[ComponentModel.Win32Exception]<errorCode>
Another useful data source is the system registry key HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps. This key includes all deployed apps and details like compliance state, error codes, etc. And it is a lot easier to get compliance and enforcement data from here instead of a log file.
By deleting a specific key, you can force redeploy of the app (more about this topic here).
But It seems like the registry doesn't show apps that don't meet requirement checks! Such apps are in the Intune log and can be easily extracted using another helper function Get-IntuneLogWin32AppReportingResultData.