Override Intune GRS: Trigger IME to retry failed Win32 App deployment

This blog post explains how you can overcome the GRS restriction which limits IME to wait for 24 hours before it can further process a Win32 App deployment after 3 consecutive failed attempts.

Background

Intune Management Extension (IME) a.k.a Intune Sidecar is instrumental in deploying Win32 apps and PowerShell scripts on the managed Windows 10 endpoints.

While processing a Win32 app deployment, the IME agent on the endpoint is hardcoded to do 3 execution retries separated by a time gap of 5 mins, to get the app deployed on the endpoint.

As such, while validating IME logs, you would see IME enters the Execution phase with marked retry count.

Override GRS: Trigger IME to retry failed Win32 App deployment - IME Execution of an app is marked with the Retry count
Override GRS: Trigger IME to retry failed Win32 App deployment – IME Execution of an app is marked with the Retry count

It is during the execution phase that IME creates the installer process to perform the app install using the install command with which the app was configured. If the app install succeeds in the subsequent attempt, it’s good.

However, if the app fails to install in all the 3 attempts, GRS (Global Reevaluation Scheme) kicks in which makes IME to ignore the app for further retries, for the next 24 hours since the last failed attempt.

Override GRS: Trigger IME to retry failed Win32 App deployment - IME skips an app execution if it has failed for previous 3 attempts and is hence blocked by Intune GRS
Override GRS: Trigger IME to retry failed Win32 App deployment – IME skips an app execution if it has failed for previous 3 attempts and is hence blocked by Intune GRS

Even if you make any changes to the app in the Intune portal (like consider making a delta change to force Intune to redeploy, or, changing the detection/install/uninstall parameters) to try to fix the deployment issue, IME will continue to ignore the app for further execution till it is in GRS and will again process the app (again 3 execution attempts) only once GRS expires.

Override GRS: Trigger IME to retry failed Win32 App deployment - IME starts processing a previously failed app for further processing only when GRS counter (24 hours) for that app has expired.
Override GRS: Trigger IME to retry failed Win32 App deployment – IME starts processing a previously failed app for further processing only when GRS counter (24 hours) for that app has expired.

You can well understand that when you are actively working on app packages to test deployment success, waiting for 24 hours is not an ideal scenario. Thus if you find yourself in such a position…

What will you do to override the IME GRS restriction?

Override GRS: Trigger IME to retry failed Win32 App deployment

  • From the IME log, note the app ID that is currently being skipped due to GRS and head straight to Windows Registry (Regedit).\
  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps\{SID}\{App GUID} where the App GUID matches with what is noted in the previous step.
Override GRS: Trigger IME to retry failed Win32 App deployment - Navigate to the IME reg path and identify the corresponding Win32 app subkey using the App ID from the IME Log
Override GRS: Trigger IME to retry failed Win32 App deployment – Navigate to the IME reg path and identify the corresponding Win32 app subkey using the App ID from the IME Log

Note: Successful deployment will always show an ExitCode 0.

  • Delete the subkey which corresponds to the app ID.
Override GRS: Trigger IME to retry failed Win32 App deployment - Delete the idenitifed corresponding Win32 app subkey
Override GRS: Trigger IME to retry failed Win32 App deployment – Delete the idenitifed corresponding Win32 app subkey
  • Restart the IME service
Override GRS: Trigger IME to retry failed Win32 App deployment - Restarting the IME service as the last step
Override GRS: Trigger IME to retry failed Win32 App deployment – Restarting the IME service as the last step

Initiating a Sync from the Company Portal app also triggers an IME sync. Or, you can also use simple run command to trigger an IME sync as explained by Oliver Kieselbach in his blog post here.

This resets the IME retry attempt counter and GRS limitations for the particular app and you would see that IME would again start processing the app.

The End

Well that was all for today. Wish you all a happy time working with with Intune Win32 app deployments with IME.

If you are interested to know more about how IME works and processes a win32 app deployment on the endpoint, do check my deep-dive post on Intune Management Extension which covers the Win32 app processing phases and troubleshooting tips. I also shared this in brief in my other blog post troubleshooting Intune app deployments using data retrieved from endpoints.

Starting 1st Jan 2021, I have started my own blog site. You can find all my latest posts here at joymalyabasuroy.com

Sharing is caring!

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.