question

Scott-6807 avatar image
0 Votes"
Scott-6807 asked GonWild-8986 answered

Using Intune powershell scripts fail to add registry values when they should not.

I have a very simple powershell script that I setup to add a registry value for a chrome management token.

Script:
Set-ItemProperty -Path Registry::"HKLM\SOFTWARE\Policies\Google\Chrome" -Name "CloudManagementEnrollmentToken" -Value "----" -Force


When I run this script manually on system it works fine.

When Intune runs this on a system without the key already present it generates the following error telling me the path is not there instead of creating the entry:
"error from script =Set-ItemProperty : Cannot find path 'HKLM\SOFTWARE\Policies\Google\Chrome' because it does not exist.
At C:\Program Files (x86)\Microsoft Intune Management
Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_c4c07194-db96-4dfa-aa15-1c705a740608.ps1:2 char:1
+ Set-ItemProperty -Path Registry::"HKLM\SOFTWARE\Policies\Google\Chrom ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (HKLM\SOFTWARE\Policies\Google\Chrome:String) [Set-ItemProperty], ItemNo
tFoundException
+ FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.SetItemPropertyCommand"


However on a system that already has this key in place Intune successfully runs the script:
"cmd line for running powershell is -executionPolicy bypass -file "C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Scripts\00000000-0000-0000-0000-000000000000_c4c07194-db96-4dfa-aa15-1c705a740608.ps1"
Powershell script is successfully executed."

I have even tried the following scripts to force it to check for the presence and then create the value if it is not present, but they fail when running them manually so I have not attempted to deploy with them.
2nd Script:

$registryPath = "HKLM\SOFTWARE\Policies\Google\Chrome\"
$Name = "CloudManagementEnrollmentToken"
$value = "----"

IF(!(Test-Path $registryPath))
{
New-Item -Path $registryPath -Force | Out-Null
New-ItemProperty -Path $registryPath -Name $name -Value $value -PropertyType SZ -Force | Out-Null} ELSE { New-ItemProperty -Path $registryPath -Name $name -Value $value
-PropertyType SZ -Force | Out-Null}


3rd Script:
$reg = Get-Itemproperty -Path "HKLM\SOFTWARE\Policies\Google\Chrome" -Name CloudManagementEnrollmentToken

if(-not($reg)){

New-Itemproperty -path "HKLM\SOFTWARE\Policies\Google\Chrome" -name "CloudManagementEnrollmentToken" -value "----" -PropertyType "SZ"
} else
{
Set-ItemProperty -path "HKLM\SOFTWARE\Policies\Google\Chrome" -name "CloudManagementEnrollmentToken" -value "----****e" -PropertyType "SZ"


I am sure my 2nd and 3rd script attempts are just written poorly, but I don't understand why the first script does not work when deploying via Intune.

Any tips or suggestions would be appreciated.




mem-intune-general
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I know this is old, just noting for info. I came to this article looking for updated methods of modifying reg with InTune as of April 2022. We deploy regedit cmd with w32 app, which is silly, for the same reason as OP, PS scripts do not seem to work as expected for user context changes. I can't address this specific issue with PS.

However, for anyone coming here for the Google Cloud Browser Management Enrollment, as of April, the admx policies for Chrome are now included with the built in administrative templates for InTune. You can just deploy a config with the admin template policy "The enrollment token of cloud policy on desktop" at \Google\Google Chrome

No more messing with ingestion or OMA, or workarounds like direct regedits. Hope this helps!

0 Votes 0 ·
Jason-MSFT avatar image
0 Votes"
Jason-MSFT answered

Did you configure the script to run in the 64-bit PowerShell Host?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Crystal-MSFT avatar image
0 Votes"
Crystal-MSFT answered Crystal-MSFT commented

@Scott-6807 Thanks for posting in our Q&A. From your description, I noticed that the first script you provided was failed to deploy with Intune. If there is any misunderstanding, please feel free to let us know.

For this issue, I have done some tests. Firstly I made this script run on my test pc, it generated the same error like this:
88987-image.png

When I tried to create the key: 'HKLM\SOFTWARE\Policies\Google\Chrome' manually in Registry editor and run the script again, it can be worked fine.
In this situation, I also try to proceed to deploy this PowerShell script with Intune, it is working as well
89001-image.png

Could you double check on one affected device to see if the registry key: 'HKLM\SOFTWARE\Policies\Google\Chrome' is exiting and then run the script manually on this affected device to see if it will get any error?

If it will get error, I think our issue can be that some devices with the above registry key can deployed successfully. But the devices without it can fail with error.

Hope the above information can help



image.png (37.4 KiB)
image.png (222.7 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Scott-6807 How are things going? I am writing to see if there's any update. If there's anything we can help, feel free to let us know.

0 Votes 0 ·
BasdeRidder-0619 avatar image
0 Votes"
BasdeRidder-0619 answered

@Scott-6807 @Jason-MSFT

Same issue here and on a few other scripts
Now the script runs if you launch powershell as administrator, the problem is the users we are pushing out to are not admin

I would expect the script run as system but this does not seem to be the case (We are not running it as current user) and tried pushing to both a user and a machine group)

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

GonWild-8986 avatar image
0 Votes"
GonWild-8986 answered

I had a similar problem
This setting fails via Intune powershell scripts:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Dell\UpdateService\Clients\CommandUpdate\Preferences\CFG" -Name "ShowSetupPopup" -Value 0 -Type Dword
From AgentExecutor.log: Set-ItemProperty : Cannot find path "HKLM:\SOFTWARE\Dell\UpdateService\Clients\CommandUpdate\Preferences\CFG" because it does not exist.

Running the line manually (as local admin) works.

Checking 'YES' for "Run script in 64 bit PowerShell Host" when deploying it through Intune, this cmdlet works.

(thanks to @Jason-MSFT )

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.