The fixes you run twenty times a month — clear the stuck print queue, rebuild the Outlook profile, reset Teams cache — can become one-click remediations users trigger themselves or the RMM pushes automatically. AI drafts the detection and fix scripts; you harden them for unattended execution, the least forgiving runtime there is.
Tier: Advanced · Workflow area: Scripting & automation · ~40 minutes per remediation
This playbook takes a proven manual fix and packages it as an Intune remediation or RMM library script: a detection script that decides whether to act, a remediation script hardened for zero-supervision execution, and honest counting that records these as resolved issues — not vanished tickets.
Pick the candidate with data. From ticket history: frequency ≥ 10/month, one documented fix with a high first-time success rate, and a machine-detectable condition. Write the one-line contract: "IF [detectable state] THEN [fix] is safe and sufficient." If you cannot write that sentence, stop here.
Generate the detection script — the real safety mechanism. Intune's remediation model runs detection first; remediation only fires on a detected state. Demand precision:
Write an Intune detection script (PowerShell) for: Windows print
spooler wedged — service running but jobs stuck.
Requirements:
- Detect ONLY the true condition: spooler service Running AND
oldest job in any local queue older than 30 minutes
- Exit 1 (remediate) only when both hold; exit 0 otherwise —
including every ambiguous or error case. When unsure, exit 0.
- No state changes of any kind in detection
- Runs as SYSTEM, PowerShell 5.1, no modules beyond built-in
- Write a one-line status to stdout either way (Intune captures it)
The fail-closed rule — unsure means exit 0 — is what separates a remediation from a fleet incident.
Generate the remediation script, hardened for unattended. Same fix you do by hand, plus the unattended armor: re-verify the condition before acting (state changes between detection and remediation), idempotent steps, timeouts on every wait, no user interaction, structured output for the console, and a final self-check that the fix took:
# Core shape the generated script must have
if (-not (Test-SpoolerWedged)) { Write-Output "Condition cleared; no action"; exit 0 }
Stop-Service Spooler -Force -ErrorAction Stop
Remove-Item "$env:SystemRoot\System32\spool\PRINTERS\*" -Force
Start-Service Spooler
if ((Get-Service Spooler).Status -eq "Running") {
Write-Output "Remediated: queue cleared, spooler restarted"; exit 0
} else { Write-Output "FAILED: spooler did not restart"; exit 1 }
Run the full pb-21 review, then the unattended review. All five points (WhatIf-equivalent reasoning, least privilege, error paths, secrets, analyzer) — then the unattended extras: what happens on a laptop mid-Teams-call, at 9 a.m. on a domain controller mistakenly in the group, twice in a row, during a Windows update? Each question gets a written answer in the script header.
Pilot on a ring, then deploy scoped. In Intune: Devices → Scripts and remediations → Create, upload both scripts, run as SYSTEM, assign to a pilot group of 20–50 devices on an hourly schedule for a week. Review the per-device detection/remediation output daily; false-positive detections are the thing you are hunting. Then widen to the target group — scoped to the device types in the contract, never All Devices by reflex.
Wire up self-service where users feel the pain. Company Portal can expose user-triggered remediations; RMM platforms have self-service trays; even a Service Catalog item that fires the script via the RMM API works. Self-service converts "call the desk and wait" into "click and fixed in 60 seconds" for the impatient majority.
Count it honestly. Each remediation gets a dashboard: detections, successful remediations, failures. Report these as auto-resolved issues — a real workload category with its own count — not as vanished demand. When leadership sees "print-queue tickets down 90%", the remediation's run count is the evidence of where they went; this is the pb-44 measurement discipline applied at the fix layer. Failures above ~5% mean the contract sentence is wrong — pull it back to pilot.
Remediation scripts run as SYSTEM across the fleet — they are among the highest-value targets in your estate; store them in version control with review history, restrict who can edit the deployed versions, and never embed credentials or tenant secrets in script bodies.
A packaged remediation is proven knowledge promoted into infrastructure: AI drafts the pair, the fail-closed detection bounds the risk, the pilot ring earns the rollout — and honest run-count reporting turns disappearing tickets into visible, creditable work.