Waitlist · planned for Dec 1, 2026
Win32 Deployment Doctor
Read-only PowerShell diagnostics for Microsoft Intune Win32 app deployments: a Win32 app tenant audit and an on-device IME log diagnostic, with HTML and JSON reports. Kit 2 of the Deployment Doctor, from ZakitPro.
Free ESP triage checklist
Starts with ESP app tracking, where most Win32 install hangs show up first.
Double opt-in: confirm from your inbox and the checklist is on its way. Unsubscribe anytime. Privacy
What it checks
Tenant pre-check (read-only Graph)
For each Win32 app it reads the definition, assignments, dependencies and supersedence, and the install summary, then checks:
- 32-bit PowerShell in install or uninstall commands, environment variables in uninstall, ServiceUI in commands
- Detection scripts that can write to STDERR or never write to STDOUT
- Product-code detection pinned to a version; detection rules that hard-code a 32-bit location or use the 64-bit view
- User install context; large packages left on the default timeout (heuristic)
- Return codes: 1618 not mapped to Retry, hard-reboot return codes
- Dependency graph size and supersedence chain length; superseding app not assigned; dependency on a superseded app; supersedence auto-update
- allowedArchitectures vs. applicableArchitectures, install-summary failures, untargeted auto-install dependencies
- Optional: whether the Intune Windows Agent enterprise app is disabled
Each app is checked on its own: one that can't be evaluated gets a Warning and the rest are still reported.
Device diagnostic (no Graph, no network)
Parses the IME logs (IntuneManagementExtension, AppWorkload, AppActionProcessor, including rolled-over files) with a clean-room CMTrace parser, reads the Win32Apps registry state and the IME service version, builds a per-app timeline and matches signals to the known-causes signal map. It can analyse a copied log folder offline and cross-reference the tenant report.
Local HTML report
Each script writes one self-contained HTML dashboard next to its JSON report: a health score, status cards (Critical, Warning, Passed, Info), a findings table with severity labels, evidence and a next-step link to Microsoft Learn, filters, light and dark themes, and print layout. No external files, CDNs, web fonts or telemetry.
Free beta scripts
Try the scripts now on GitHub
The Kit 2 scripts (v1.2.2) are public under the MIT license: zakopenc/win32-deployment-doctor-beta. Check each file against its SHA256 checksum on the verify page before you run it.
Test in non-production first. The scripts have been checked only with PSScriptAnalyzer and Pester unit tests that use mocked Graph responses and synthetic data. They have not been run on a real tenant or a real device. Provided as is under the MIT license, with no warranty.
Autopilot or Device Preparation instead?
The Autopilot + Device Prep Deployment Doctor (Kit 1) covers ESP and Device Preparation. It's on presale now at $39, with files by Dec 1 and a full refund until 14 days after delivery. Its free Pre-Check Lite does not cover Win32 apps.
FAQ
- When does it come out?
- The Win32 App Deployment Doctor (Kit 2) is planned for Tuesday, December 1, 2026, sold in a bundle with the Autopilot + Device Prep Deployment Doctor. Founding prices: Both Doctors Solo $59, Team / MSP $149. Each kit has to pass our release check before it goes on sale, and a kit that does not pass ships later. Waitlist members get an email when it ships.
- Can I try it now?
- Yes. The beta scripts (scripts v1.2.2, matching Kit 2 v1.3.2) are free under the MIT license in the win32-deployment-doctor-beta repository on GitHub. They have been checked only with PSScriptAnalyzer and Pester unit tests that use mocked Graph responses and synthetic data, not on a real tenant or device, so test them in non-production first.
- What is the difference between the beta scripts and the paid kit?
- The scripts are byte-identical to the ones in the matching paid kit. The beta repository ships a trimmed signal map: cause IDs, match patterns, status and source links. The explanations and fixes from the paid kit are not included, and reports show "Removed from the beta scripts repo" in their place.
- Does it change anything in my tenant?
- No. The tenant pre-check uses delegated, read-only Microsoft Graph scopes, and a guard refuses any HTTP method other than GET. The device diagnostic uses no Graph and no network. The local HTML and JSON report files are the only thing the scripts write.
- What permissions does it need?
- The tenant pre-check needs DeviceManagementApps.Read.All and Group.Read.All, plus Application.Read.All only with -IncludeAgentAppCheck, and the Microsoft.Graph.Authentication 2.x module. The device diagnostic needs no Graph scopes; local admin is recommended because of the IME log folder ACL.
- Which PowerShell versions does it support?
- Windows PowerShell 5.1 or PowerShell 7.x. The device diagnostic runs on the Windows device itself, or offline on a copied log folder.
- How do I check the files are genuine?
- Each file has a published SHA256 checksum, in SHA256SUMS.txt in the repository and on the zakitpro.com verify page, which also shows how to check a file with Get-FileHash.
Links: beta repository · checksums · Intune app error lookup