Skip to content
Trending
Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface Simplify Windows Devices to Run Only the Required Applications using Intune Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys Updated Windows Device Sync Experience Enhances Per-Device Troubleshooting Configure Windows Sandbox vGPU Policy using Intune for Better Graphics Performance or Reduced Attack Surface
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment

Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment

Written By Joymalya Basu Roy
Last Updated August 15, 2024
Posted In Intune
SHARE

Let’s discuss Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment. In this blog post, I will explain how to overcome the GRS restriction.

GRS restriction limits IME to waiting 24 hours after 3 consecutive failed attempts before it can further process a Win32 App deployment.

Intune Management Extension (IME), a.k.a. Intune Sidecar, is instrumental in deploying Win32 apps and PowerShell scripts on managed Windows 10 endpoints.

While processing a Win32 app deployment, the IME agent on the endpoint is hardcoded to do three execution retries separated by a time gap of 5 minutes to get the app deployed on the endpoint.

Patch My PC

Intune Management Extension (IME)

As such, while validating IME logs, you would see IME enters the Execution phase with a marked retry count.

Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.1
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.1

IME creates the installer process during the execution phase to perform the app install using the install command with which the app was configured. If the app install succeeds in the subsequent attempt, it’s good.

However, if the app fails to install in all the 3 attempts, GRS (Global Reevaluation Scheme) kicks in, which makes IME ignore the app for further retries for the next 24 hours since the last failed attempt.

Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.2
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.2

Even if you make any changes to the app in the Intune portal (like considering making a delta change to force Intune to redeploy or changing the detection/install/uninstall parameters) to try to fix the deployment issue, IME will continue to ignore the app for further execution until it is in GRS and will again process the app (again, 3 execution attempts) only once GRS expires.

Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.3
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.3

You can understand that waiting 24 hours is not ideal when actively working on app packages to test deployment success; thus, if you find yourself in such a position, what will you do to override the IME GRS Restriction?

Override GRS: Trigger IME to retry failed Win32 App Deployment

  • From the IME log, note the app ID that is currently being skipped due to GRS and head straight to Windows Registry (Regedit).\
  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps\{SID}\{App GUID} where the App GUID matches with what is noted in the previous step.
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.4
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.4

Note: Successful deployment will always show an ExitCode 0.

  • Delete the subkey that corresponds to the app ID.
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.5
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.5
  • Restart the IME service.
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment - Fig.6
Override Intune GRS: Trigger IME to Retry Failed Win32 App Deployment – Fig.6

Initiating a Sync from the Company Portal app also triggers an IME sync. As Oliver Kieselbach explains in his blog post here, you can also use the simple run command to trigger an IME sync.

This resets the IME retry attempt counter and GRS limitations for the particular app, and you will see that IME will again start processing the app.

The End

Well, that was all for today. I wish you all a happy time working with Intune Win32 app deployments with IME.

If you want to learn more about how IME works and processes a Win32 app deployment on the endpoint, please check my deep-dive post on Intune Management Extension, which covers the Win32 app processing phases and troubleshooting tips. I also briefly shared this in my other blog post, Troubleshooting Intune app deployments using data retrieved from endpoints.

Starting 1st Jan 2021, I have started my blog site. You can find all my latest posts here at joymalyabasuroy.com

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Joymalya Basu Roy is an experienced IT service professional with almost 5 years of experience working with Microsft Intune. He is currently working as a Senior Consultant – Architect at Atos India. He is an ex-MSFT, where he worked as a Premiere Support Engineer for Microsoft Intune. He was also associated with Wipro and TCS in the early stages of his career. He was awarded the Microsoft MVP award for Enterprise Mobility in 2021. You can find all his latest posts on his blog site, MDM Tech Space, at https://joymalya.com

Written by

Joymalya Basu Roy is an experienced professional in the IT services field with almost 5 years of experience working with Microsft Intune. He is currently working as a Senior Consultant - Architect with Atos India. He is an ex-MSFT where he worked as a Premiere Support Engineer for Microsoft Intune. He was also associated with Wipro and TCS in the early stages of his career. He is awarded the Microsoft MVP award for Enterprise Mobility in 2021. You can find all his latest posts on his own blog site MDM Tech Space at https://joymalya.com

Discussion · 2 comments

  1. Seems like MS changed it since this blogpost was written as I don’t see a “ExitCode” regkey but thanks to your beautiful post I was able to find the new GRS markers.
    Now there’s a new subkey under \Win32Apps\{SID}\ called “GRS” inside you’ll find different subkeys (not sure what the subkey names refer too) one of them had the app ID that I wanted to reset, I deleted the subkey that had the app ID.

    Reply

Join the discussion

Your email address will not be published. Required fields are marked *

Related guides

Intune

Simplify Windows Devices to Run Only the Required Applications using Intune

Key Takeaways Hey, let’s learn about Simplify Windows Devices to Run Only the Required Applications using Intune. This policy lets administrators replace the default windows shell with a custom or lightweight shell. it improves performance by using system resources and is useful for devices that run a dedicated application. If the policy is disabled or […]

AC Anoop C Nair 8 min read
Intune

Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune

Key Takeaways In this post we are discussing about Enhance macOS Compliance with Custom Security and Compliance Checks to Improve Device Security using Microsoft Intune. Microsoft has announced the general availability of Custom Compliance Settings for macOS in Microsoft Intune. The feature helps organizations strengthen security controls while supporting many types of macOS management scenarios. […]

AC Anoop C Nair 4 min read
Intune

Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune

Key Takeaways In this post we are discussing Manage Samsung Galaxy Firmware Versions to Improve Security and Compliance using Microsoft Intune. Microsoft Intune has received a new update that expands firmware management capabilities for Samsung Galaxy devices through Firmware Versionsintegration. This enhancement gives IT administrators more control over firmware and operating system updates, helping them […]

AC Anoop C Nair 4 min read
Intune

MS Intune Adds Windows Registry Data Collection to Device Inventory for Single Values All Key Values and Subkeys

Key Takeaways Microsoft Intune 2607 introduces Windows Registry Data collection in Device Inventory, allowing IT admins to verify actual device configurations without relying on custom discovery or remediation scripts. Using the Properties Catalog, admins can collect registry information through Single Value, All Values Under a Key (Non-Recursive), or Same Value Across Subkeys. MS Intune Adds […]

AC Anoop C Nair 5 min read