Detection Script when using OOBE

[interas-99]

Hi,

when installing applications during OOBE, the user receives an error message during app installation.
The error message appears to be related to the detection script.

Specifically, the app can be installed successfully, but the subsequent detection fails. On systems that are already in use, the script runs flawlessly. The error is likely related to the fact that WinGet is not available during the OOBE phase (or the system user).

Is there a way to implement a check of OOBE and skip the detection using winget during that phase?

As an example, we would like to install Citrix during OOBE. We created the package as follows:

New-WtWingetPackage -PackageId Citrix.Workspace -PackageFolder C:\Intune\Packages | Deploy-WtWin32App -AvailableFor AllComputers

The OOBE phase log shows that the application could not be detect
AppWorkload.log:

<![LOG[[Win32App] SideCarScriptDetectionManager Powershell ExitCode: 10]LOG]!><time="14:12:18.9502024" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] Detection script file C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\1b0879b9-4fe2-48c5-8135-cc925d79f04d_1.ps1quotedExitCodeFilePath.txt is deleted.]LOG]!><time="14:12:18.9502024" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] Checked Powershell script result: Die Aufzeichnung wurde gestartet. Die Ausgabedatei ist "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Citrix.Workspace-detection.log".
Starting Citrix.Workspace 25.8.0.71 detection
Winget location: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.24.25199.0_x64__8wekyb3d8bbwe\winget.exe
Citrix.Workspace not detected using winget, exiting with code 10
Winget output:


]LOG]!><time="14:12:18.9502024" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] Checked Powershell script exitCode: 10 EnforceSignatureCheck: 0 RunAs32Bit: 0 InstallExRunAs: 1, result of applicationDetected: False]LOG]!><time="14:12:18.9522115" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] Detection script file C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\1b0879b9-4fe2-48c5-8135-cc925d79f04d_1.ps1 is deleted.]LOG]!><time="14:12:18.9542364" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] detectionManager SideCarScriptDetectionManager got applicationDetectedByCurrentRule: False as system]LOG]!><time="14:12:18.9562489" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App] Completed detectionManager SideCarScriptDetectionManager, applicationDetectedByCurrentRule: False]LOG]!><time="14:12:18.9562489" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">
<![LOG[[Win32App][SimulatedDetectionActionHandler] Detection for policy with id: 1b0879b9-4fe2-48c5-8135-cc925d79f04d resulted in action status: Success and detection state: NotDetected.]LOG]!><time="14:12:18.9562489" date="10-21-2025" component="AppWorkload" context="" type="1" thread="5" file="">

Citrix.Workspace-detection.log:

**********************
nStart der Windows PowerShell-Aufzeichnung
Startzeit: 20251021141527
Benutzername: WORKGROUP\SYSTEM
RunAs-Benutzer: WORKGROUP\SYSTEM
Konfigurationsname: 
Computer: DESKTOP-K67GH7A (Microsoft Windows NT 10.0.26200.0)
Hostanwendung: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -executionPolicy bypass -file C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\1b0879b9-4fe2-48c5-8135-cc925d79f04d_1.ps1
Prozess-ID: 13064
PSVersion: 5.1.26100.6584
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.26100.6584
BuildVersion: 10.0.26100.6584
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Die Aufzeichnung wurde gestartet. Die Ausgabedatei ist "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\Citrix.Workspace-detection.log".
Starting Citrix.Workspace 25.8.0.71 detection
Winget location: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.24.25199.0_x64__8wekyb3d8bbwe\winget.exe
Citrix.Workspace not detected using winget, exiting with code 10
Winget output:

**********************
Ende der Windows PowerShell-Aufzeichnung
Endzeit: 20251021141527
**********************

The Logs were collected from a device with german language configured, so sorry for the Log Language.

[svrooij]

This is a great question, I think WinGet is not available in OOBE, since it (by default) is a user app. And the provided detection script tries to use winget to detect if the app in installed.

This is because there is not one simple way to detect if an app is installed. If you're deploying a specific app like Citrix in this case, you might want to change the detection in Intune to something better.

For intune, you have 4 ways to detect an app:

1. Check registry for some key
2. Check file system for some file
3. MSI product code
4. Script

I'm thinking about making a repository to collect this extra info and than change wintuner to check this repo first. There is no silver bullet here, and the winget detection script is just a fallback if we don't have all the info.