A large share of help desk tickets are the same handful of problems: a stopped service, a full temp folder, a stale certificate, a setting someone changed back. Intune remediations scripts let you find those problems on every Windows device on a schedule and fix them automatically, often before the user notices. Each package is a pair of PowerShell scripts: one that detects the issue and one that fixes it.

This guide covers how remediations work, the licensing catch that trips up many smaller businesses, and how to write and roll out packages safely.

How remediations work

Remediations used to be called Proactive Remediations, and you will still see the old name in many places. You find them in the Intune admin center under Devices › Manage devices › Scripts and remediations.

Each script package contains:

• A detection script that checks for a problem. If it finds the issue, it must end with exit 1.
• A remediation script that fixes the problem. It runs only when detection exits with 1.
• Settings and a schedule: run once, hourly or daily, in system or user context, in 32-bit or 64-bit PowerShell.

Any exit code other than 1, including an empty result, means the issue was not found and the remediation does not run. After remediation, detection runs again so the report shows whether the fix worked.

A package can also contain only a detection script. That is useful for reporting: you can collect a piece of information from every device without changing anything.

Licensing and prerequisites

This is the part that surprises people. Remediations require users of the devices to have one of these licenses:

• Windows Enterprise E3 or E5, including through Microsoft 365 E3, E5 or F3
• Windows Education A3 or A5, including through Microsoft 365 A3 or A5
• Windows Virtual Desktop Access (VDA) per user

Microsoft 365 Business Premium on its own does not include Windows Enterprise, so it does not meet the requirement. Business Premium customers who want remediations typically add a Windows Enterprise E3 license for the users concerned. Before first use, an Intune Service Administrator must confirm the licensing requirement in the tenant, which is a one-time switch.

Devices must be Microsoft Entra joined or hybrid joined, and either enrolled in Intune running Windows Enterprise, Pro or Education, or co-managed with Configuration Manager. The Intune Management Extension installs automatically once a script, remediation or Win32 app is assigned.

Writing a good package

Here is a simple example that checks the Print Spooler service and restarts it if it has stopped. It is not exciting, but it shows the pattern.

Detection script:

$svc = Get-Service -Name 'Spooler' -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -ne 'Running') {
  Write-Output 'Spooler not running'
  exit 1
}
Write-Output 'Spooler OK'
exit 0

Remediation script:

Start-Service -Name 'Spooler' -ErrorAction Stop
Write-Output 'Spooler started'
exit 0

A few rules make packages reliable:

1. Keep detection read-only. Detection runs on every device on the schedule. It should never change anything.
2. Make remediation safe to repeat. If it runs twice, nothing bad should happen.
3. Write short, useful output. Output appears in the Intune reports, with a limit of 2,048 characters. A clear one-line status is far more useful than a full log.
4. Save scripts as UTF-8. If you enforce script signature checks, use UTF-8 without a byte order mark.
5. Choose the right context. System context for services, files and machine settings. Logged-on credentials for user settings, such as items in the user’s registry hive.
6. Test locally first. Run both scripts as SYSTEM on a test machine and check the exit codes.

Packages worth deploying

These are the kinds of packages I find useful in small and mid-size tenants. Write them to suit your environment rather than copying scripts you do not understand.

Intune also includes built-in script packages from Microsoft that you can deploy without writing anything. Review what they do before assigning them.

One caution on drifted settings: if a setting can be managed by a configuration profile, use the profile. Remediations are for the gaps that policy cannot reach, not a replacement for proper configuration.

Rolling out and monitoring

1. Create the package with a clear name and description, upload both scripts and choose settings. Leave signature checks off unless you sign your scripts.
2. Assign to a pilot device group with a daily schedule. Do not mix user and device groups across include and exclude assignments; use assignment filters if you need to narrow scope.
3. Review the device status report after a day or two: how many devices had the issue, how many were fixed, and how many failed.
4. Export the output if you need detail, then widen the assignment.
5. Use Run remediation on a single device for urgent fixes. This device action runs a package on demand when the device is online.

Watch the “issue fixed” numbers over time. If the same issue keeps coming back on the same devices, the remediation is treating a symptom and there is a root cause to find.

Frequently asked questions

Are Intune remediations included in Business Premium?

No. Remediations require Windows Enterprise E3 or E5, Education A3 or A5, or Windows VDA per user. Business Premium includes Windows Business, so you need to add Windows Enterprise licensing for users who need remediations.

How many remediation packages can I have?

Up to 200 script packages per tenant. Most small and mid-size businesses need fewer than 20.

What is the difference between a platform script and a remediation?

A platform script runs once on assignment and does not repeat. A remediation runs on a schedule, detects before it acts, and reports whether the fix worked.

We build and maintain remediation packages as part of our Intune managed service, and an Intune health check will show you where scheduled fixes would cut ticket volume. If you are deciding whether the licensing is worth it, our Microsoft 365 cost calculator helps compare plans. Microsoft’s Remediations documentation covers every setting.

Tired of fixing the same problem every week? Start with a free Microsoft 365 security assessment and we will show you what can be automated.