Deploy PowerShell Script
Overview
Platform Scripts run PowerShell on devices. Use when a setting isn't available in Settings Catalog.
Key difference:
- Run as System → For system-wide changes (remove apps, set wallpaper)
- Run as User → For user-specific changes (PWA installs, user registry)
Create a Platform Script
Step 1: Navigate
Intune → Devices → Scripts and remediations → Platform scripts
Step 2: Add Script
Click + Add → Windows 10 and later
Step 3: Basics
- Name: Descriptive name (e.g.,
BCM-Remove-Bloatware) - Description: What this script does
- Click Next
Step 4: Script Settings
| Setting | System Script | User Script |
|---|---|---|
| Script file | Upload your .ps1 file |
Upload your .ps1 file |
| Run using logged on credentials | No | Yes |
| Enforce script signature check | No | No |
| Run in 64-bit PowerShell | Yes | Yes |
Click Next
Step 5: Assignments
- Select All Devices or a specific group
- Click Next
Step 6: Review + Create
Click Create
When to Use System vs User
| Task | Run As |
|---|---|
| Remove bloatware apps | System |
| Set wallpaper via registry | System |
| Install PWA for user | User |
| Map network drive | User |
| Configure AnyDesk license | System |
Script Runs Once
Platform scripts run once per device at next check-in. If you need it to run repeatedly (e.g., enforce a setting users can change), use Proactive Remediations instead.
Location: Devices → Scripts and remediations → Remediations
Check Script Status
- Go to Devices → Scripts and remediations → Platform scripts
- Click your script
- Check Device status tab
- Look for Success/Failed/Pending
Force Script to Run Again
Scripts only run once. To re-run:
- Delete the script from Intune
- Wait for devices to sync
- Re-create the script
- Assign again
Or modify the script slightly (add a comment) and upload as new version.
Troubleshooting
Script shows as "Failed":
- Check the script for syntax errors
- Test locally first:
powershell -ExecutionPolicy Bypass -File script.ps1 - Check if it needs System vs User context
Script succeeded but nothing changed:
- Wrong context (System vs User)
- Script ran but user logged in later
- Need reboot/logoff for changes to apply
Script not running at all:
- Device not syncing
- Device not in assigned group
- Script blocked by execution policy (use Bypass in script)
#bcm/procedure/intune/script