Fix the Intune Management Extension on Windows

When Win32 apps, scripts or remediations stay stuck on a Windows device, look at the Intune Management Extension (IME) first: it is what runs them. Here you read what the IME does, how you see that it is stuck and how you get it working again.

What does the Intune Management Extension do?

The IME is an agent that runs next to Windows’ built-in MDM management. On a device that meets the prerequisites, Intune installs it by itself as soon as you assign something that needs it, such as a PowerShell script, a Win32 app or a remediation. It handles Win32 apps, PowerShell scripts and remediations, among other things. Remote Help needs it for notifications and for unattended sessions.

The service is called IntuneManagementExtension; in Services it is listed as Microsoft Intune Management Extension. Its logs are usually in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. IntuneManagementExtension.log is the main log; for Win32 apps Microsoft points to AppWorkload.log.

How often does the IME check in?

Microsoft gives two answers. The page on the IME says it checks every 8 hours for new or changed installations, separately from the regular MDM check-in. The page on Win32 apps says it checks every hour for new Win32 app assignments, and at a restart of the service or the device. On top of that, the IME looks for new app assignments as soon as the Enrollment Status Page or Windows Autopilot device preparation finishes, and since late September 2026 Intune sends a push notification when Win32 apps change. So do not count on a fixed moment: if you want the IME to look now, make it check in yourself.

What Intune itself offers

• Restart the service. Microsoft describes this in Task Manager: find IntuneManagementExtension under Services, right-click it and select Restart. The IME then checks in with Intune at once.
• Sync from the admin center. Through Devices > All devices > the device > Sync you start an MDM check-in and, when the IME is on the device, also an IME check-in.
• Sync by the user. In the Company Portal through Settings > Sync, with the same effect.

When a new check-in does not solve it, further investigation on the device itself is needed.

What Endpoint Toolbelt adds

Endpoint Toolbelt lets an ordinary user, or the service desk next to them, fix the IME without admin rights:

• The check App installer (IME) shows whether the service runs and when it last fetched apps, with the error of a failed attempt, such as a 401, 403 or a proxy error.
• Retry apps & policies makes the IME look again at once and shows for each app how far its last attempt got.
• Full IME reset clears the IME’s app state, downloads and policy cache and has the device fetch everything again. Scripts and remediations are left alone.
• Create support package collects all IME logs and the device’s diagnostics in one zip file for the service desk.