Intune Management Extension not installing

[Scott Paterson]

I am testing Intune/EMS on Windows 10 (1709) PCs and trying to get Powershell scripts to run without success. I think the issue is with the Intune Management Extension not installing but cant find much information on how to troubleshoot this particular issue.

Can anyone advise how I get Powershell scripts to run ? TIA

Scott

[#2]

I reset the broken machine and still broken. I left it overnight and still not working. I reset it again and still broken. What I did find is if I manually downloaded https://prodamsub0102data.azureedge.net/IntuneWindowsAgent.msi and ran it, my script started installing immediately. I just can't figure out what is blocking the agent from downloading and installing after the reset.

Any ideas @Oliver Kieselbach ?

[#3]

I will see what I can investigate...

[#4]

Looks like you can use MDM to push-install that IntuneInstaller.MSI that you found. 

I added it as an app with my OpenDNS and AV installs.

[#5]

It would appear the issue has been resolved somehow by Microsoft.

I attempted to replicate the exact problem twice yesterday -  In both trials, The intune agent properly deployed itself and ran powershell script after a system was wiped, while retaining AzureAD Enrollment.

I did not require the use of additional work-arounds like force-deploying the intune.msi as a Line-of-Business app

[#6]

I also have the same issue. Because of manual enrollment the Intune Management Extension does not install. I tried installing it manually as mentioned here, with IntuneWindowsAgent.msi.

It installs succesfully; I can see it in apps & features and I can see the files in C:\Program Files (x86)\Microsoft Intune Management Extension.

However, after some minutes, it somehow uninstalls itselfs. The files in the directory disappear.

From event manager:

Event ID 11724 Product: Microsoft Intune Management Extension -- Removal completed successfully.

Event ID 1034 Windows Installer removed the product. Product Name: Microsoft Intune Management Extension. Product Version: 1.16.105.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Removal success or error status: 0.

@Oliver Kieselbach

@JarrettB

Any idea? Thanks

[#7]

I have the same problem.

Because all devices are manually joined to intune, they don't receive the Intune Management Extension.

I want to use powershell scripts, so I tried installing the extension manually as mentioned here (IntuneWindowsAgent.msi).

It installs succesfully and I can see the extension in programs & features and see the files in C:\Program Files (x86)\Microsoft Intune Management Extension.

However, after some minutes, it somehow uninstalls itself; the files are gone from the folder and it disappeared from apps & features.

Event manager:
Event ID 11724 Product: Microsoft Intune Management Extension -- Removal completed successfully.

Event ID 1034 Windows Installer removed the product. Product Name: Microsoft Intune Management Extension. Product Version: 1.16.105.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Removal success or error status: 0.

@Oliver Kieselbach  or @JarrettB Any idea?

[#8]

It might be that MS is pushing this uninstall as the device is not meant to be an agent device, but this is pure speculation. Microsoft is aware of this problem that people want to use the agent without going through the OOBE enrollment again.

Can you and others in this thread provide me numbers of effected clients? How many clients do you want to have under Intune agent management and are currently blocked due to this.

I'm asking to share the details of your deployment blockers with Intune PG. Are we talking about just a few devices or several thousand? Thanks.

[#9]

Hmm, it certainly looks like it could be something like that. Sometimes it takes 5min to uninstall, sometimes 20min or longer.

I don't really see why it matters whether a machine is auto-enrolled via GPO or manually joined to be supported for powershell usage. 
Let's hope Microsoft adds the functionality soon. In my case it's around 100 devices.

[#10]

@Oliver KieselbachWe have around 250 manually enrolled

[#11]

In my case it is enrolled through OOBE but a different issue. Basically if you go through 2 x Reset this PC the agent does not come down. I found if I leave the device for about 2-4 days it will eventually come down. This is just in my lab but easy to reproduce over and over again. I have not tried lately since a month or so. Just an observation and not an urgent issue.

[#12]

Good news to all, the "Intune In Development" site does list a feature which will be released soon that solves the agent install on devices not auto-enrolled, see here:

Configure your Win32 apps to be installed on Intune enrolled Azure AD joined devices 

You'll be able to assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices. For more information about Win32 apps in Intune, see Win32 app management.

https://docs.microsoft.com/en-us/intune/in-development#configure-your-win32-apps-to-be-installed-on-...

best,

Oliver

[#13]

@Oliver Kieselbach 

Hmm, their wording is a bit confusing again:

"You'll be able to assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices."

Every Intune MDM device is "intune enrolled", regardless of whether this was manual/gpo/etc.

Also, I don't have any problems with Azure AD joined devices. The problem is regarding Hybrid AD devices.

On both hybrid and Azure AD joined devices, I use the "connect work or school account" (auto-enrollment MDM set-up). The Azure AD machines receive the intune management extension, while the hybrid ones do not.

[#14]

@Oliver Kieselbach 

Found this under the roadmap:

Microsoft Intune expands Win32 app deployment capabilities

Building upon the existing support for line-of-business (LOB) apps and Microsoft Store for Business apps, administrators can now use Microsoft Intune to deploy most of their organization’s existing applications on Windows 10 devices. Administrators can add, install, and uninstall applications for Windows 10 users in a variety of formats such as MSI, MSP, and Setup.exe This feature is available in public preview as of CY Q4 2018

https://www.microsoft.com/en-us/microsoft-365/roadmap?rtc=3&filters=Microsoft%20Intune

This "update" is the win32 support that's already in public preview; I don't think it's related to the intune management extension not being installed.

[#15]

Hi @WalterPrem,

I'm sorry the roadmap your are refering to is an old item. Your entry describes the Win32 app support in general. This support is provided by the Intune since a few month now and is handeled by the Intune Management Agent which gets pushed down and is then in charge of installing all the .intunewin packaged setup.exe Win32 apps.

I'm refering to a feature which is upcoming. See the link again it is the "In-Development" site from Intune which announces new features beeing released soon (most of the time next month, that's why the site is called "In development for Microsoft Intune - April 2019".

There is the entry:

Configure your Win32 apps to be installed on Intune enrolled Azure AD joined devices 

You'll be able to assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices. For more information about Win32 apps in Intune, see Win32 app management.

This basically describes that the agent who is in charge installing all the Win32 apps will now be installed even for non auto-enrollment devices.

best,

Oliver

[#16]

@Oliver Kieselbach 

Hi,

Hm, let's hope you're right then. As I set in my reply before that, I can already deploy my win32 apps to "Intune enrolled Azure AD joined devices". The problem is regarding Hybrid joined devices that didn't use GPO, but the auto-enroll "add work/school" method.

Any ETA on this update?

Thank you,

Walter

[#17]

@WalterPrem 

Intune and auto-enrolled AADJ/hybrid devices are covered, in fact this is the requirement for the Intune Management Agent (auto-enrollment)

With the upcoming change AADJ devices which are enrolled into Intune afterwards are covered then.

The change does not mentioning Hybrid joined devices. It seems this situation will not change.

Only people ho started with AADJ and enrolling these devices later on to Intune via add Work/school account are covered then. but hey maybe it also covers hybrid but the entry does only talk about AADJ

best,

Oliver

[#18]

@Oliver Kieselbach 

Only people ho started with AADJ and enrolling these devices later on to Intune via add Work/school account are covered then. but hey maybe it also covers hybrid but the entry does only talk about AADJ

Right. In my case the devices were already AAD registered (not joined) and then manually added to intune via add work/school account. This doesn't work.

Let's hope they fix this problem too. I don't see why it would be any different than AAD joined PCs using the connect school/work button.

[#19]

@Oliver Kieselbach 

Well, the update you mentioned is now under "What's new" for last week:

https://docs.microsoft.com/en-us/intune/whats-new

"You can assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices."

At the same time, win32 apps are no longer in preview (coincidence..?).

Unfortunately, my hybrid AD,  add work/school joined device, still doesn't receive the intune management extention. I tried removing them from intune and re-enrolling. I re-added them to the software distribution group. Regular apps get installed, but the win32 hangs on "waiting for install status". The Win32 apps don't appear in portal on the client, and the Intune management extension doesn't get installed.

I'm guessing that - unfortunately - this only applies to Azure AD joined machines who are not yet enrolled into Intune.

I hope the same will be done for Hybrid machines; Hybrid is listed as supported by Microsoft, and I don't see why it would matter whether a device is hybrid or azure joined, when both use the same method to enroll.

If you could pass this feedback in any way that would be great.

Thanks,

Walter

[#20]

@Oliver Kieselbach 

Well, the update you mentioned is now under "What's new" for this week:

https://docs.microsoft.com/en-us/intune/whats-new

"You can assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices."

At the same time, win32 apps are no longer in preview (coincidence..?).

Unfortunately, my hybrid AD,  add work/school joined device, still doesn't receive the intune management extention. I tried removing them from intune and re-enrolling. I re-added them to the software distribution group. Regular apps get installed, but the win32 hangs on "waiting for install status". The Win32 apps don't appear in portal on the client, and the Intune management extension doesn't get installed.

I'm guessing that - unfortunately - this only applies to Azure AD joined machines who are not yet enrolled into Intune.

I hope the same will be done for Hybrid machines; Hybrid is listed as supported by Microsoft, and I don't see why it would matter whether a device is hybrid or azure joined, when both use the same method to enroll.

If you could pass this feedback in any way that would be great.

Thanks,

Walter

@Oliver Kieselbach 

[#21]

@Oliver Kieselbach 

Well, the update you mentioned is now under "What's new" for this week:

"You can assign your Win32 apps to be installed on Intune enrolled Azure AD joined devices."

At the same time, win32 apps are no longer in preview (coincidence..?).

Unfortunately, my hybrid AD, add work/school joined device, still doesn't receive the intune management extention. I tried removing them from intune and re-enrolling. I re-added them to the software distribution group. Regular apps get installed, but the win32 hangs on "waiting for install status". The Win32 apps don't appear in portal on the client, and the Intune management extension doesn't get installed.

I'm guessing that - unfortunately - this only applies to Azure AD joined machines who are not yet enrolled into Intune.

I hope the same will be done for Hybrid machines; Hybrid is listed as supported by Microsoft, and I don't see why it would matter whether a device is hybrid or azure joined, when both use the same method to enroll.

If you could pass this feedback in any way that would be great.

Thanks,

Walter