Azure Intune: Windows Remediations

Windows devices enrolled in Intune
Access to the Witness console to download the device registration bundle (see Section 1)
Scripts from the remediation_scripts folder of the downloaded bundle:

Detection: ps1: PAC/registry checks; also includes stunnel health checks if STunnel was enabled when the bundle was downloaded
Remediation: ps1: Witness Anywhere registration / install script

An interactive user logged on during remediation

1. Download the remediation bundle from the Witness console

In the Witness console, open the Download Device Registration Script dialog.
Configure the download options:

Platform: select Intune (Windows).
Static Domain (Optional): enter the static domain if one is used for your tenant (e.g. ai).
STunnel (Optional): this toggle controls what the generated detection script validates:

Enabled: the detection script includes stunnel health logic: it verifies that stunnel is installed under the user profile, the process is running, and it is listening as expected, in addition to the PAC/registry checks.
Disabled: the detection script contains no stunnel logic and validates only the Witness Anywhere PAC/registry configuration.

Click Download.

Extract the downloaded bundle. It contains two folders: platform_scripts and remediation_scripts.

For this deployment, use the scripts from the remediation_scripts folder: detection.ps1 and register_device.ps1. These are the two files uploaded to the Intune remediation package in Section 4. (The folder also contains flush.ps1, which is not used in the remediation package.)

2. Create the remediation package

Open Microsoft Intune admin center
Go to Devices → Scripts and remediations
Select the Remediations tab
Click + Create → create a custom script package

3. Basics

Enter the Name, Description, and Publisher information as shown below, then click Next.

Field	Recommended value	Notes
Name	Witness Anywhere Registration
Description	Detect Witness Anywhere configuration and automatically remediate by registering the device when required.	Helps operators identify purpose later
Publisher	Your name / team

4. Settings

Upload the following scripts (from the remediation_scripts folder of the downloaded bundle):

Detection script: ps1
Remediation script: ps1

Configure the script settings as follows:

Run this script using the logged-on credentials: No (runs as the SYSTEM account to perform privileged operations such as certificate installation, stunnel deployment, and other system-level configuration changes)
Enforce script signature check: No
Run script in 64-bit PowerShell: No
Click Next to proceed

5. Scope tags

Leave Default unless your tenant uses custom scope tags. Click Next.

6. Assignments

Configure the assignment settings:

Assign to: Select the target Windows device group(s).
Schedule: Set the schedule to Hourly for faster deployment and self-healing.
Filter: (Optional) Apply a filter, such as Windows 10/11 devices only.
Click Next to proceed

7. Review + create

Review the configuration, then click Create to deploy the Intune remediation package.

The package appears under Devices → Scripts and remediations → Remediations with status Active once assigned.

8. How Intune uses the scripts

Every schedule interval (e.g. hourly)

│

▼

detection.ps1

│

├── exit 0 → Compliant → stop (no remediation)

│

└── exit 1 → Non-compliant → run register_device.ps1

Detection checks

WitnessAI registry has PAC_URL + DEVICE_FINGERPRINT for the logged-on user
Internet Settings AutoConfigURL matches that PAC_URL
stunnel.exe / stunnel.conf under the user profile (only if STunnel was enabled at download)
stunnel process running (only if STunnel was enabled at download)
Listening on 127.0.0.1:9411 (only if STunnel was enabled at download)

Note: if the bundle was downloaded with STunnel disabled, checks 3 to 5 are not present in the detection script and only the PAC/registry checks (1 and 2) are performed.

Remediation behavior

Registers the device with PEAS (if not already registered)
Installs root CA, sets PAC proxy / AutoConfigURL
Deploys stunnel (when the bundle was downloaded with STunnel enabled)
If already registered, re-enforces app configs

9. Validate on a device

After the schedule runs (or after a sync), on the Windows endpoint check:


C:\Windows\Temp\intune-witness-remediation.log

Look for:

[DETECTION] or [DETECTION_STUNNEL]: RUN START / RESULT=Compliant or NonCompliant
[REMEDIATION]: RUN START / RESULT=Success or Failed

Detailed registration transcript:


C:\Windows\Temp\pac-registration-log.txt

Also confirm in Windows Settings → Network & internet → Proxy that Use setup script is on and points at the Witness PAC URL when remediation succeeds.

Note: In some cases, even though detection and remediation complete successfully on the device, the Intune console fails to report the result on subsequent runs. If the console does not show an updated status, rely on the device-side logs below to confirm that detection and remediation actually ran.

Intune Deployment Guide: Witness Anywhere (Windows Remediations)Prerequisites 1. Download the remediation bundle from the Witness console 2. Create the remediation package 3. Basics 4. Settings 5. Scope tags 6. Assignments 7. Review + create 8. How Intune uses the scripts Detection checks Remediation behavior 9. Validate on a device