How to Configure Microsoft Intune Proactive Remediations Using PowerShell to Autonomously Repair Broken SCCM Client Agents

In modern endpoint management, maintaining the health of the management agents themselves is a paradoxical challenge. If the Microsoft Endpoint Configuration Manager (SCCM / MECM) client agent becomes corrupt, its WMI repository breaks, or its background services fail to start, the device essentially disappears from the management console. It cannot receive the scripts required to fix the agent because the agent itself is broken. To resolve this “chicken-and-egg” scenario, administrators must leverage a secondary, cloud-native management channel: Microsoft Intune. By utilizing Intune’s Proactive Remediations feature, administrators can deploy autonomous PowerShell scripts that continuously evaluate and repair broken SCCM clients, ensuring persistent dual-management co-management health.

The Architecture of Proactive Remediations

Proactive Remediations are a component of Intune Endpoint Analytics. Unlike standard Intune PowerShell scripts that run once at startup, Proactive Remediations execute on a recurring schedule (e.g., daily or hourly).

A remediation package consists of two distinct PowerShell scripts:

1. The Detection Script: This script queries the endpoint to determine if it is healthy. It exits with code 0 if healthy, and code 1 if an issue is detected.
2. The Remediation Script: If the detection script returns code 1, Intune immediately triggers the remediation script to execute the necessary repair commands.

Because Intune operates via the cloud-based Intune Management Extension (IME)—which operates entirely independently of the on-premises SCCM agent—it can reach down and repair the SCCM agent even if the device hasn’t checked into the on-premises infrastructure for weeks.

Writing the Detection Script

The detection script must definitively prove the SCCM client is broken. We can check if the CcmExec service is running and if the WMI namespace exists.

# Detect-SCCMHealth.ps1

try {
    # Check if the service exists and is running
    $service = Get-Service -Name "CcmExec" -ErrorAction Stop
    if ($service.Status -ne 'Running') {
        Write-Output "SCCM Service is not running."
        exit 1
    }

    # Verify WMI namespace health
    $wmi = Get-WmiObject -Namespace "root\ccm" -Class "SMS_Client" -ErrorAction Stop
    if (-not $wmi) {
        Write-Output "SCCM WMI Namespace is broken."
        exit 1
    }

    Write-Output "SCCM Client is healthy."
    exit 0
} catch {
    Write-Output "SCCM Client missing or catastrophic failure."
    exit 1
}

Writing the Remediation Script

If the detection script exits with code 1, the remediation script fires. A robust remediation script attempts to restart the service, and if that fails, performs a brutal WMI reset and triggers an automatic re-installation of the agent from a network share or a pre-cached directory.

# Remediate-SCCMClient.ps1

try {
    Write-Output "Attempting to restart CcmExec service..."
    Restart-Service -Name "CcmExec" -Force -ErrorAction Stop
    Start-Sleep -Seconds 10
    
    $check = Get-Service -Name "CcmExec"
    if ($check.Status -eq 'Running') {
        Write-Output "Service restarted successfully."
        exit 0
    }
} catch {
    Write-Output "Service restart failed. Initiating repair installation."
}

# If restart fails, trigger the MSI repair (assuming setup files are cached locally)
$setupPath = "C:\Windows\ccmsetup\ccmsetup.exe"
if (Test-Path $setupPath) {
    Start-Process -FilePath $setupPath -ArgumentList "/repair" -Wait
    Write-Output "Repair installation triggered."
    exit 0
} else {
    Write-Output "ccmsetup.exe not found. Manual intervention required."
    exit 1
}

Deploying the Remediation Package in Intune

With the scripts written, you must deploy them via the Intune portal.

1. Navigate to the Microsoft Intune admin center.
2. Go to Reports > Endpoint analytics > Proactive remediations.
3. Click Create script package.
4. Name the package “Autonomous SCCM Client Repair”.
5. Upload Detect-SCCMHealth.ps1 as the detection script and Remediate-SCCMClient.ps1 as the remediation script.
6. Crucially, ensure Run this script using the logged-on credentials is set to No. The scripts must execute in the SYSTEM context to restart services and trigger installations.
7. Assign the package to your target device group and set the schedule to run Daily.

Once deployed, the Intune Management Extension on the Windows endpoints will silently execute the detection script every 24 hours. If a user maliciously stops the SCCM service, or if WMI corrupts, Intune will instantly detect the failure and autonomously execute the repair sequence, restoring the endpoint’s management health without generating a helpdesk ticket.