Intune Application Troubleshooting: A step-by-step guide

The following is a deep dive into troubleshooting when Intune apps fail to install, and the steps to fix the issue.

In MEM, go to Home – Apps to check the status of the install:

If the install shows failed, go to Device Install Status.

In this case, the error is “The system cannot find the file specified (0x80070002)”.

The content may not be downloading locally.

The app will try to install 3 times.

On a client machine, open Services and stop and start the “Microsoft Intune Management Extension” service to start the install again.

On the client machine go to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

IntuneManagementExtension.log : Tracks the Intune Management extension component events

AgentExecutor : Track any PowerShell execution events

ClientHealth.log :  Track client-health related events

Open IntuneManagementExtension.log for all app install errors

Check Detection Rules

Checking if app already installed, search for [Win32App] ProcessDetectionRules starts

If it is not detected it at the beginning of the install it will return:

[Win32App] Detected app f9648098-07c5-4693-a4a9-150f4f98697a without history, skip next step

If it is detected it will return:

[Win32App] Checked reg path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 78.4.1 ESR (x64 en-US), name: , operator: 0, type: 1, value: , result of application Detected: True

Check Applicability

This is for diskspace, memory, cpu settings that were defined in the deployment.

Check Content download

Search for “Content cache miss for app id”

The app first downloads to C:\Program Files (x86)\Microsoft Intune Management Extension\Content\Incoming as an encrypted file. This is a temporary download folder for further processing. The extension of the file will be in bin format.

Staging folder

The download file moves from “Incoming” folder to “Staging folder”. In Staging Folder, the downloaded file will be in Zip format.

C:\Program Files (x86)\Microsoft Intune Management Extension\Content\

Staging\86995d21-f2ed-4e2c-a88e-1ef5f65_1\86995d21-f2ed-4e2c-a88e-1ef5f65_1.zip

Hash verification and Decryption

Hash value checked to ensure downloaded content is consistent. Decryption starts after hash verification.

[Win32App] Starts verifying encrypted hash

[Win32App] hmac validation is pass.

[Win32App] file hash validation pass, starts decrypting

[Win32App] Decryption is done successfully.

[Win32App] CDN mode, content is decrypted.

The Intune CDN URL used to download the file if you suspect any download issue due to network proxy. You can copy the URL and paste download in your browser to troubleshoot.

Find it by searching [Win32App DO] start creating a new download job

[Win32App DO] start creating a new download job, FileId = 501FCB7D-A970-4E34-A753-4B48FE5D8BEF_5f7fe094-c48b-4cbf-b43e-d13814330562_842325ea-235c-44f3-bf88-bde45219eca6_fb03a916-ec85-4081-91b5-9938afb2397b-intunewin-bin_04fdcde5-6db2-4e2c-8ef9-ec578581011c_1, remote URL = http://swda01.manage.microsoft.com/5f7fe094-c48b-4cbf-b43e-d13814330562/842325ea-235c-44f3-bf88-bde45219eca6/fb03a916-ec85-4081-91b5-9938afb2397b.intunewin.bin

Clean up Staging content

Once unzip completes then temporary content in the staging folder removed.

Search for : [Win32App] Unzipping file on session

Cleaning up staging content C:\Program Files (x86)\Microsoft Intune Management Extension\Content\Staging\86995d21-f2ed-4e2c-a88e-1ef5f65d02e3_1

Starting application installation

If the content being downloaded is fine, then move to the installation stage.

The zipped file gets unzipped to C:\windows\IMECache\<GUID> and the install directory is set:

**Shown is the uninstall of the app.

Launched the Intune application installation in machine context.

While troubleshooting, you can make a note of the process id to track.

The Installation process is completed.

[Win32App] Installation is done, collecting result

Detection Rules after Application Installation

Post application installation, the Intune client evaluate application detection rules in the computer. In our example detection Logic is MSI product code. WMI query is used to detect the MSI product code.

MSI detection:

[Win32App] Checked ProductCode {5B0C7A0B-0B5A-4552-8E06-0CC630F2C50A}, Found it. sideCarProductCodeDetectionMetadata.ProductVersionOperator is 0 applicationDetected: True

Regkey detection:

Compliance State Message

State messages processed as shown below. These state messages are being delivered back to Intune as part of Intune Win32 App Troubleshooting.

State message results get sent to the Intune cloud service.

During and after Users are presented with toast messages:

Downloading:

Success:

So what about my original error message?

It was because I changed the name of the .intunewin file. Changed it back to Deploy-Application.intunewin, stopped and started the service, and it installed.