The latest articles on DEV Community by Wisam Al-maghribi (@wisam_almaghribi_1499704). https://dev.to/wisam_almaghribi_1499704 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4195724%2F0bf80074-0ad5-4372-9c82-47e512584003.jpg https://dev.to/wisam_almaghribi_1499704 en Wisam Al-maghribi Tue, 20 Oct 2026 08:36:34 +0000 https://dev.to/wisam_almaghribi_1499704/intune-0x87d1041c-record-detection-evidence-before-rebuilding-2bne https://dev.to/wisam_almaghribi_1499704/intune-0x87d1041c-record-detection-evidence-before-rebuilding-2bne <p>An Intune Win32 app can appear installed while its detection result says otherwise. Before rebuilding the package, make the disagreement explicit.</p> <p>This is documentation-based guidance, prepared with AI assistance. It is not a claim of testing in your environment. I run EndpointCraft; the free resource linked below is ours. No Microsoft affiliation.</p> <h2> Keep three observations separate </h2> <p>Start a small record for one pilot device:</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Observation</th> <th>What to record</th> </tr> </thead> <tbody> <tr> <td>Installer outcome</td> <td>Result, timestamp and intended execution context</td> </tr> <tr> <td>Installed state</td> <td>Expected app/version and artifact actually present</td> </tr> <tr> <td>Detection outcome</td> <td>Exact rule, context and result</td> </tr> </tbody> </table></div> <p>The point is to give the next test a clear question. If the expected artifact is absent, investigate installation. If it is present but the rule misses it, inspect detection and context. Do not treat a status label as proof of the expected installed version.</p> <h2> Check the rule's contract </h2> <p>For custom Win32 detection, Microsoft's documentation specifies a zero exit code and STDOUT output for a detected result. STDERR output can cause a not-installed result. Also check process architecture and the relevant file/registry view.</p> <p>Read the <a href="https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32#step-4-detection-rules" rel="noopener noreferrer">official detection-rule requirements</a> for the current behavior. Requirement scripts, detection scripts and remediation scripts serve different purposes; avoid transferring exit-code assumptions between them.</p> <h2> Test the missing-app case too </h2> <p>A rule that always reports installed can conceal a failed deployment. Keep a small matrix: clean install, already installed, uninstall and upgrade when in scope. Record what you changed, the observed result and the evidence needed for the next decision.</p> <p>Use a pilot and preserve your original evidence. Do not post raw customer logs, tenant identifiers, device names or credentials in public questions. A sanitized statement of expected versus observed state is a better starting point.</p> <h2> A free working record </h2> <p>EndpointCraft's <a href="https://endpointcraft-win32-resources.wisamomar.chatgpt.site/free-checklist/?campaign=dev_guide" rel="noopener noreferrer">standalone Win32 preflight checklist and blank evidence sheet</a> are ungated downloads. No email signup is required. They do not install software or guarantee a rollout result, and they are not excerpts from the paid toolkit.</p> <p>What evidence do you wish came with every package handoff?</p> intune powershell