How to Create Desktop Shortcuts Using Microsoft Intune with PowerShell
Deploy desktop shortcuts for applications and web URLs across Windows devices using Microsoft Intune PowerShell scripts. Three methods: Platform Scripts, Win32 apps, and Remediations.
- Difficulty
- Intermediate
- Time required
- 20 minutes
- Steps
- 5
- Platform
- Intune
Table of contents
Quick Answer
Go to the stepsCreate a PowerShell script using WScript.Shell to create .lnk files in $env:Public\Desktop. Upload to Intune at Devices > Manage devices > Scripts and remediations > Platform scripts. Set execution to SYSTEM context. Assign to device groups.
- Write a PowerShell script using WScript.Shell to create .lnk files in $env:Public\Desktop.
- In Intune, go to Devices > Manage devices > Scripts and remediations > Platform scripts.
- Click Add > Windows 10 and later, upload the script.
- Set Run this script using the logged on credentials to No (runs as SYSTEM).
- Assign to device groups and monitor deployment status.
Intune admin center > Devices > Manage devices > Scripts and remediations > Platform scriptsExpected result: Desktop shortcuts appear in C:\Users\Public\Desktop and are visible to all users on the device.
Key takeaways
- Use PowerShell with WScript.Shell to create shortcuts in $env:Public\Desktop, then deploy via Intune Platform Scripts, Win32 apps, or Remediations.
Before you start
- Access
- Access to the Intune admin center at intune.microsoft.com with Intune Administrator role.
- Required roles
- Intune Administrator
- Required licenses
- Microsoft Intune Plan 1 (Platform Scripts)
- Windows Enterprise E3/E5 (Remediations only)
- Microsoft Intune Plan 1 (Platform Scripts and Win32 apps)
- Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 (Remediations)
- Environment
- Windows 10 or later enrolled in Intune. Target applications must be installed on devices before creating app shortcuts.
- Vendor
- Microsoft
- Tested environment
- Verified against Intune admin center and Platform Scripts documentation, July 2026.
- Administrator permissions required
Warning: Scripts run as SYSTEM, not as the user
Intune Platform Scripts run in SYSTEM context. Target $env:Public\Desktop for shortcuts visible to all users. Don't use $env:USERPROFILE\Desktop, as it points to the SYSTEM profile, not the logged-in user.
Note: Remediations require additional licensing
Intune Remediations (for auto-recreating deleted shortcuts) require Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 licensing beyond standard Intune Plan 1.
1Create a PowerShell script for desktop shortcuts
Write a PowerShell script that creates .lnk files on the public desktop using WScript.Shell.
Create a .ps1 file using the WScript.Shell COM object. Target $env:Public\Desktop. Set TargetPath to the app executable or URL. Optionally set IconLocation and Description. Use try/catch with exit 0 (success) and exit 1 (failure).
For web URL shortcuts, set TargetPath to the full URL (e.g., https://portal.office.com). The default browser opens when users click it. Test the script locally in an elevated PowerShell session before uploading to Intune.
Expected result: Running the script locally creates .lnk files in C:\Users\Public\Desktop that launch the correct application or URL.
Note
Use shell32.dll icons for consistency: 103 (globe), 14 (document), 23 (question mark), 70 (notepad). Format: $env:SystemRoot\System32\shell32.dll,103
2Deploy the script via Intune Platform Scripts
Upload the script to Intune and deploy it to target devices.
Intune admin center > Devices > Manage devices > Scripts and remediations > Platform scripts > AddIn the Intune admin center at intune.microsoft.com, go to Devices > Manage devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later. Upload your .ps1 file. Set Run this script using the logged on credentials to No, Enforce script signature check to No, Run script in 64-bit PowerShell Host to Yes.
Assign to device groups. Start with a pilot group. Platform Scripts run once per device and don't re-execute unless modified. For persistent shortcuts, use Remediations (Step 4).
Expected result: Script shows Succeeded in device status. Shortcuts appear in C:\Users\Public\Desktop on target devices.
Note
Platform Scripts are included with Intune Plan 1. The IME checks for new assignments roughly every 8 hours. Force a sync from Settings > Accounts > Access work or school > Info > Sync.
3Package as a Win32 app for detection and uninstall
Deploy shortcuts as a Win32 app for detection rules, reporting, and uninstall.
Intune admin center > Apps > All Apps > Add > Windows app (Win32)Package your script with the Win32 Content Prep Tool. Upload the .intunewin file in Intune under Apps > All Apps > Add > Windows app (Win32). Set install command: powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File Create-DesktopShortcuts.ps1. Set an uninstall command that removes the shortcuts.
Configure a file-based detection rule: Path C:\Users\Public\Desktop, File YourShortcut.lnk, Detection method: File or folder exists. If detection fails (shortcut deleted), Intune marks the app as Not installed and can reinstall.
IntuneWinAppUtil.exe -c SourceFolder -s Create-DesktopShortcuts.ps1 -o OutputFolderExpected result: Win32 app shows Installed. Detection rule confirms shortcut file exists.
Note
Win32 apps provide better reporting than Platform Scripts and built-in self-healing through detection rules. If detection fails, Intune reinstalls the app automatically.
4Set up Remediations for automatic shortcut maintenance
Set up automatic monitoring and recreation of deleted shortcuts.
Intune admin center > Devices > Manage devices > Scripts and remediations > RemediationsCreate a detection script (exit 0 if shortcuts exist, exit 1 if missing) and a remediation script that recreates missing shortcuts. In Intune, go to Devices > Manage devices > Scripts and remediations > Remediations > Create script package. Upload both scripts. Set execution to SYSTEM context.
Assign to device groups with a Daily schedule. Remediations require Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 licensing. If you don't have these licenses, use the Win32 app method from Step 3 instead.
Expected result: Remediation runs on schedule. Deleted shortcuts are recreated at the next run. Device status shows Without issue or With issue.
Note
Remediations need Windows Enterprise E3/E5 licensing per Microsoft Learn. Verify at Tenant administration > Connectors and tokens > Windows data. Platform Scripts and Win32 apps only need Intune Plan 1.
5Monitor deployment and troubleshoot issues
Verify deployment and resolve common failures.
Intune admin center > Devices > Scripts and remediationsCheck deployment status in Intune for each method. On the device, run Get-ChildItem $env:Public\Desktop\*.lnk to list shortcuts. If shortcuts don't appear, check the Intune Management Extension log at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.
To force an Intune sync: Settings > Accounts > Access work or school > Info > Sync. Don't use gpupdate /force, that's for Group Policy, not Intune MDM. Common failures: wrong desktop path ($env:USERPROFILE instead of $env:Public), missing target app, or script exit code not 0.
Get-ChildItem "$env:Public\Desktop\*.lnk" | Select-Object Name, CreationTimeExpected result: Deployment shows Succeeded/Installed. Shortcuts visible in C:\Users\Public\Desktop.
Note
Always test scripts locally in an elevated PowerShell session before deploying through Intune. Add Start-Transcript to capture detailed logs for troubleshooting.
How to Confirm Shortcuts Are Deployed
Confirm configuration
A successful deployment places .lnk files in C:\Users\Public\Desktop visible to every user. Platform Scripts show Succeeded status. Win32 apps confirm via detection rules. Remediations show Without issue when shortcuts are present.
Shortcuts on the public desktop appear automatically in most cases without requiring log off/on. Windows Explorer monitors the public desktop folder and updates the desktop view.
Normal result: Shortcuts visible on desktop. Intune reports Succeeded/Installed. Shortcuts launch correct app or URL.
Abnormal result: Shortcuts missing or broken. Check IME log for errors. Common causes: wrong desktop path, missing target app, or script exit code not 0.
Platform Script
Shortcuts created once
Script runs once. Shortcuts persist until manually deleted.
Win32 App
Shortcuts with detection
Detection rule confirms shortcut exists. Intune reinstalls if detection fails.
Remediation
Auto-recreated shortcuts
Daily check recreates missing shortcuts automatically.
Troubleshooting
Shortcuts appear in SYSTEM profile instead of public desktop
Warning
Cause: Script uses $env:USERPROFILE\Desktop which resolves to SYSTEM profile.
Change the target path to $env:Public\Desktop. This is at C:\Users\Public\Desktop and is visible to all users on the device.
Script shows Failed status in Intune
Warning
Cause: Script didn't exit with code 0 or threw an unhandled exception.
Wrap logic in try/catch. Use exit 0 for success, exit 1 for failure. Add Start-Transcript for logging. Test locally in elevated PowerShell before uploading.
Shortcuts created but icons are missing or generic
Note
Cause: Icon path doesn't exist on the device or icon index is wrong.
Use shell32.dll icons for reliability since this file exists on all Windows installations. Format: $env:SystemRoot\System32\shell32.dll,103 where 103 is the icon index.
Remediations tab shows licensing notice
Warning
Cause: Remediations require Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 licensing.
Verify licensing at Tenant administration > Connectors and tokens > Windows data. If unavailable, use the Win32 app method with file-based detection rules for similar self-healing.
Shortcuts don't appear after Intune sync
Note
Cause: Script hasn't been delivered yet or device hasn't checked in.
Force sync from Settings > Accounts > Access work or school > Info > Sync. Don't use gpupdate /force (that's for Group Policy, not Intune). Allow up to 8 hours for normal IME check-in.
Frequently asked questions
Why target $env:Public\Desktop instead of user desktops?
Intune Platform Scripts run as SYSTEM. $env:USERPROFILE resolves to the SYSTEM profile, not the user's. $env:Public\Desktop places shortcuts where all users can see them. This is the standard approach.
Platform Scripts vs Win32 apps vs Remediations for shortcuts?
Platform Scripts: simplest, one-time execution. Win32 apps: detection rules, uninstall, better reporting. Remediations: scheduled checks that auto-recreate deleted shortcuts. Choose based on persistence needs.
Do users need to log off for shortcuts to appear?
Usually not. Explorer monitors the public desktop folder and updates automatically. In rare cases, a desktop refresh (F5) or logoff/logon may help.
Can I deploy shortcuts to specific users only?
Possible but not recommended. User-context scripts can fail due to permissions. The standard approach is $env:Public\Desktop for all users. If needed, test user-context Remediations thoroughly.
How do I use a custom icon instead of shell32.dll icons?
Host the .ico file on a web server or Azure Blob Storage. Download it to a local path (e.g., C:\ProgramData\CompanyIcons\app.ico) in your script before setting IconLocation. Handle download failures gracefully.
Conclusion
Intune provides three PowerShell-based methods for desktop shortcuts: Platform Scripts for one-time deployment, Win32 apps for detection and uninstall support, and Remediations for automatic maintenance.
All methods target $env:Public\Desktop for visibility across all users. The WScript.Shell COM object creates .lnk files, and proper exit codes let Intune track deployment status.
Use PowerShell with WScript.Shell to create shortcuts in $env:Public\Desktop, then deploy via Intune Platform Scripts, Win32 apps, or Remediations.
Intune admin center > Devices > Manage devices > Scripts and remediations > Platform scriptsSources2
