Using Intune to configure a Scheduled Task to start a service at User logon

If you are looking for a way to execute a command at user logon then this blog may just help you. Recently, I dealt with an issue where users were being prompted to provide UAC credentials in order to allow running of a background service against an application installed using Company Portal. The name of the application is Nord VPN Teams and since I was working with this application for the first time, I knew very little about it. However, if your users are not admin users and are setup as Standard Users then it is not hard to imagine that users can receive such prompts from time to time.

To get around this, I immediately thought of using Proactive Remediation Scripts feature in Intune. However, the issue with using Proactive Remediation Scripts at the moment is that one cannot make the script run at User logon.

Enter the use of good old Task Scheduler in Windows. The solution involves the following at a high level -

1. Define a PS script to detect the status of the service and start it if stopped.

2. Copy the script locally on the end user devices.

3. Create a Schedule Task.

4. Configure the trigger actions and settings.

Even though I am not using Proactive Remediation Scripts feature, I took the inspiration from one of the default scripts Restart stopped Office C2R svc and modified it to suit my needs.

Detection and starting the service -

# define your PS script here

$content = @'

$svcCur = "NordVPN.Teams.VpnService"

$curSvcStat,$svcCTRSvc,$errMsg = "","",""

$ctr = 0

# First, let's make sure nothing has changed since detection and service exists and is stopped

Try{        

    $svcCTRSvc = Get-Service $svcCur

    $curSvcStat = $svcCTRSvc.Status

    }

Catch{    

    $errMsg = $_.Exception.Message

    Write-Error $errMsg

    Exit 1

    }

        

# If the service got started between detection and now (nested if) then return

# If the service got uninstalled or corrupted between detection and now (else) then return the "Error: " + the error

If ($curSvcStat -ne "Stopped"){

    If ($curSvcStat -eq "Running"){

        Write-Output "Running"

        Exit 0

    }

    Else{

        Write-Error $errMsg

        Exit 1

    }

}

# Okay, the service should be there and be stopped, we'll change the startup type and get it running

Try{        

    Set-Service $svcCur -StartupType Automatic

    Start-Service $svcCur

    $svcCTRSvc = Get-Service $svcCur

    $curSvcStat = $svcCTRSvc.Status

        While ($curSvcStat -eq "Stopped"){

            Start-Sleep -Seconds 5

            ctr++

            if(ctr -eq 12){

                Write-Output "Service could not be started after 60 seconds"

                Exit 1

            }

        }

    }

Catch{    

    $errMsg = $_.Exception.Message

    Write-Error $errMsg

    Exit 1

    }

'@

 

The second part of the script is to use the content from the first part and dump it locally on targeted devices.

Create and dump the PS file -

# create custom folder and write PS script

$path = $(Join-Path $env:ProgramData AutopilotScripts)

if (!(Test-Path $path))

{

New-Item -Path $path -ItemType Directory -Force -Confirm:$false

}

Out-File -FilePath $(Join-Path $env:ProgramData AutopilotScripts\Start-NordVPNTeams-Service_v1.0.ps1) -Encoding unicode -Force -InputObject $content -Confirm:$false

The third part of the script is to create the Schedule Task that will run at User logon and trigger action to execute the Start service script covered above.

Create Schedule Task at User Logon -

# register script as scheduled task

$TriggerLogon = New-ScheduledTaskTrigger -AtLogOn

$STPrin = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount

$CustomPath = 'C:\ProgramData\AutopilotScripts\Start-NordVPNTeams-Service_v1.0.ps1'

$Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ex bypass -file $CustomPath"

$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries

Register-ScheduledTask -Action $Action -Settings $Settings -Trigger $TriggerLogon -TaskName "Start-NordVPNTeams-Service-AtLogon" -Principal $STPrin

Put them all together and deploy the complete script using the Scripts feature in Intune.

1. Sign-in to the Microsoft Endpoint Manager admin center portal. 
2. Browse to Devices – Windows – PowerShell Scripts
3. Click on Add
4. Give a Name
5. Select the script
6. Set Run this script using the logged on credentials as No
7. Set Enforce script signature check to No
8. Set Run script in 64 bit PowerShell Host as Yes
9. Deploy to the user\device based group.

End Result

The Startup part of the script is created at the intended location.

The Schedule Task is created with the correct configuration.

Start the Task only if the computer is on AC power is unchecked due to the use of -AllowStartIfOnBatteries parameter.

After a restart, the Schedule Task ran once the user logged in and the service started automatically. There were no more UAC prompts.

Happy days..