IntuneScriptLab
0.29.0
Test Intune scripts before Intune does: static rules, a runtime harness, Pester assertions, a Graph
pre-flight over the tenant's deployed scripts and readers for the agent's logs
Minimum PowerShell version
5.1
Installation Options
Owners
Copyright
(c) 2026 Jeffrey Stuhr. All rights reserved.
Package Details
Author(s)
- Jeffrey Stuhr
Tags
Intune Remediation Win32 PSScriptAnalyzer Lint Endpoint Pester
Functions
Test-IntuneScript Invoke-IntuneDetectionTest Invoke-IntuneRemediationTest Invoke-IntunePlatformScriptTest Invoke-IntuneWin32AppTest Invoke-IntuneRequirementTest Test-IntuneWin32Rule Test-IntuneWin32Requirement Get-IntuneAgentLog Get-IntuneAgentTimeline Export-IntuneAgentDiagnostic Get-IntuneAnalyzerRulePath Test-IntuneDeployedScript Compare-IntuneDeployedScript Get-IntuneScriptHealth Export-IntuneFindingSarif Repair-IntuneScript Test-IntuneAssignmentFilter Assert-HaveIntuneStatus Assert-BeIntuneDetected Assert-NotBeIntuneDetected Assert-HaveIntuneRunState Assert-PassIntuneAnalysis Assert-BeIntuneApplicable Assert-NotBeIntuneApplicable
PSEditions
Dependencies
This module has no dependencies.
Release Notes
0.29.0 - A remediation that writes to stderr is a script error on the device whatever its exit code:
RemediationStatus 3, Graph scriptError, the error text attached, no post-detection.
Invoke-IntuneRemediationTest reported Recurred for that run since round 1; it reports Failed,
skips the post-detection and warns that the exit code was 0. A detection's stderr still changes
nothing. IslOutputIssue warns about Write-Error and an unguarded cmdlet in a remediation script,
with -ErrorAction Stop as the fix. Measured in user context on the lab device with five one-off
remediations, recorded as round 11 (REM-STDERR-*). See CHANGELOG.md.
0.28.0 - Test-IntuneScript analyzes a script about two and a half times faster, with the syntax tree
walked once and indexed instead of once per rule; Get-IntuneAgentLog reads a large log
filtered in a fifth of the time. Repair-IntuneScript takes -Context, -Architecture and
-EnforceSignatureCheck like Test-IntuneScript, and applies eight more edits: -Force on
Install-Module and its kin, -ErrorAction SilentlyContinue on a probing cmdlet, exit 1 for an
exit code Intune reads as 1, $env:ProgramW6432, 'ARM64|AMD64', $PSScriptRoot, a
Get-Credential -Credential call that returns what it was handed, a Set-ExecutionPolicy or
#Requires -Version 7 line removed. Test-IntuneDeployedScript judges a device group by its
member counts rather than its first 20 members; every Graph request is retried on 429, 503
and 504. Invoke-IntuneDetectionTest, Invoke-IntunePlatformScriptTest and
Invoke-IntuneRequirementTest take script paths from the pipeline; every result type has a
format view. The in-box module table is held against the host's Windows PowerShell by a
test, as the PowerShell 7-only tables are. See CHANGELOG.md.
0.27.0 - Harness: a user-context run started from PowerShell 7 gave the 5.1 host PowerShell 7's
module path (no Cert: drive, Security cmdlets failing to load); -Credential did not find
a Microsoft Entra account's session, because Windows names such an account after its
display name and not its sign-in name; a refused folder grant lost its message under
-ErrorAction Stop on 5.1. Rules, from a tenth validation round: IslPowerShell7Syntax says
that a 7-only cmdlet, parameter or -Parallel fails where it stands and the script carries
on, and flags Out-File -Encoding utf8NoBOM, which was listed and never matched;
IslInteractiveCall warns instead of erring when Get-Credential -Credential is handed
something that may be a built credential; IslContextIssue's drive-letter finding is
Information, since the letter cannot say whether it is a mapped drive.
Repair-IntuneScript no longer turns 'return 1; exit 1' into '1; exit 0; exit 1' with no
finding left. Help: what Invoke-ScriptAnalyzer -Severity does with the custom rules. See
CHANGELOG.md.
Earlier versions, 0.1.0 to 0.26.0: CHANGELOG.md, which ships with the module.
FileList
- IntuneScriptLab.nuspec
- CHANGELOG.md
- Private\Get-IslAgentLogEvent.ps1
- Private\Invoke-IslProcess.ps1
- Public\Test-IntuneAssignmentFilter.ps1
- IntuneScriptLab.Format.ps1xml
- Private\Get-IslCoreOnlyFeature.ps1
- Private\Invoke-IslScriptRun.ps1
- Public\Test-IntuneDeployedScript.ps1
- Private\Get-IslDesktopModulePath.ps1
- Private\New-IslFinding.ps1
- Public\Test-IntuneScript.ps1
- IntuneScriptLab.psd1
- Private\Get-IslDeviceFact.ps1
- Private\Resolve-IslAccount.ps1
- Public\Test-IntuneWin32Requirement.ps1
- IntuneScriptLab.psm1
- Private\Get-IslDsregStatus.ps1
- Private\Resolve-IslRulePath.ps1
- Public\Test-IntuneWin32Rule.ps1
- LICENSE
- Private\Get-IslExportReport.ps1
- PSScriptAnalyzer\IntuneScriptLab.Rules.psm1
- Private\Rules\Find-IslArchitectureIssue.ps1
- README.md
- Private\Get-IslFilterDeviceFact.ps1
- Public\Assert-IntuneResult.ps1
- Private\Rules\Find-IslArm64Assumption.ps1
- en-US\about_IntuneScriptLab.help.txt
- Private\Get-IslFilterProperty.ps1
- Public\Compare-IntuneDeployedScript.ps1
- Private\Rules\Find-IslContextIssue.ps1
- en-US\IntuneScriptLab-Help.xml
- Private\Get-IslHostPath.ps1
- Public\Export-IntuneAgentDiagnostic.ps1
- Private\Rules\Find-IslEncodingIssue.ps1
- Examples\intune-script-gate.yml
- Private\Get-IslInboxModule.ps1
- Public\Export-IntuneFindingSarif.ps1
- Private\Rules\Find-IslExecutionPolicyCall.ps1
- Examples\IntuneScriptLab.settings.psd1
- Private\Get-IslIntuneOutput.ps1
- Public\Get-IntuneAgentLog.ps1
- Private\Rules\Find-IslExitCodeIssue.ps1
- Examples\IntuneScripts.Tests.ps1.template
- Private\Get-IslLogonSession.ps1
- Public\Get-IntuneAgentTimeline.ps1
- Private\Rules\Find-IslInteractiveCall.ps1
- Examples\Invoke-IntuneScriptGate.ps1
- Private\Get-IslMsiProduct.ps1
- Public\Get-IntuneAnalyzerRulePath.ps1
- Private\Rules\Find-IslLongSleep.ps1
- Private\Compare-IslRequirementOutput.ps1
- Private\Get-IslOemEncoding.ps1
- Public\Get-IntuneScriptHealth.ps1
- Private\Rules\Find-IslModuleDependency.ps1
- Private\Compare-IslRuleValue.ps1
- Private\Get-IslScriptContext.ps1
- Public\Invoke-IntuneDetectionTest.ps1
- Private\Rules\Find-IslOutputIssue.ps1
- Private\ConvertFrom-IslCmTraceLog.ps1
- Private\Get-IslSetting.ps1
- Public\Invoke-IntunePlatformScriptTest.ps1
- Private\Rules\Find-IslPowerShell7Syntax.ps1
- Private\ConvertFrom-IslFilterRule.ps1
- Private\Get-IslSuppression.ps1
- Public\Invoke-IntuneRemediationTest.ps1
- Private\Rules\Find-IslRebootCommand.ps1
- Private\ConvertFrom-IslRuleSpec.ps1
- Private\Get-IslWindowsReleaseBuild.ps1
- Public\Invoke-IntuneRequirementTest.ps1
- Private\Rules\Find-IslRelativePath.ps1
- Private\ConvertTo-IslCmTraceTime.ps1
- Private\Grant-IslFolderAccess.ps1
- Public\Invoke-IntuneWin32AppTest.ps1
- Private\Rules\Find-IslScriptSize.ps1
- Private\Find-IslAstNode.ps1
- Private\Invoke-IslGraphRequest.ps1
- Public\Repair-IntuneScript.ps1
- Private\Rules\Find-IslSignatureIssue.ps1