How to Manage Registry Keys with Microsoft Intune for GPO Migration
Learn how to deploy and enforce Windows Registry key configurations using Microsoft Intune through Remediations, Platform Scripts, and Win32 apps when migrating from Group Policy Objects.
- Difficulty
- Intermediate
- Time required
- 15 minutes
- Steps
- 8
- Platform
- Intune
Table of contents
Quick Answer
Go to the stepsMicrosoft Intune manages registry keys through PowerShell scripts, not through a built-in registry editor. Use Remediations for continuous enforcement with detection and remediation script pairs. Use Platform Scripts for one-time registry changes. Use Win32 apps for registry settings tied to application deployment. All three methods are configured at Devices > Scripts and remediations in the Intune admin center.
- Sign in to the Intune admin center at intune.microsoft.com.
- Navigate to Devices > Manage devices > Scripts and remediations.
- Create a detection script (exit 0 = compliant, exit 1 = non-compliant) and a remediation script.
- Upload both scripts as a Remediation script package, set execution context and schedule.
- Assign to a device group and monitor compliance in the Device status tab.
Microsoft Intune admin center > Devices > Manage devices > Scripts and remediationsExpected result: Registry keys are deployed to targeted Windows devices and, with Remediations, continuously enforced on the schedule you configure.
Key takeaways
- You'll learn three methods to manage Windows Registry keys using Microsoft Intune: Remediations for continuous enforcement, Platform Scripts for one-time changes, and Win32 apps for install-time registry configuration.
- Group Policy Objects handle registry modifications natively, but Intune doesn't offer the same built-in capability. Migrating to cloud management requires PowerShell-based approaches to maintain registry configurations across your device fleet.
- Use Intune Remediations with paired detection and remediation PowerShell scripts for continuous registry enforcement, or Platform Scripts for one-time changes when migrating from Group Policy.
Introduction
When organizations move from on-premises Active Directory to cloud management with Microsoft Intune, one of the biggest gaps they face is registry key management. Group Policy Preferences let you create, modify, and delete registry values natively. Intune doesn't have an equivalent built-in feature.
Instead, Intune relies on PowerShell scripts to achieve the same results. You have three deployment methods available: Remediations (paired detection and remediation scripts that run on a schedule), Platform Scripts (one-time script execution), and Win32 applications (scripts packaged for install-time deployment with detection rules).
This tutorial walks through each method end to end. You'll create detection and remediation scripts, configure execution contexts for HKLM and HKCU registry hives, deploy via the Intune admin center, and set up monitoring to confirm compliance across your managed devices.
Who this is for: IT administrators and MSPs transitioning from on-premises Active Directory Group Policy management to cloud-first endpoint management with Microsoft Intune.
Before you start
- Access
- Access to the Microsoft Intune admin center at intune.microsoft.com with Intune Administrator or Global Administrator role. Target devices must be enrolled in Intune and running Windows 10 version 1903 or later.
- Required roles
- Intune Administrator
- Global Administrator (alternative)
- Required licenses
- Microsoft Intune Plan 1 (Platform Scripts and Win32 apps)
- Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 (Remediations)
- Microsoft Intune Plan 1 (for Platform Scripts and Win32 apps)
- Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 (for Remediations)
- Environment
- Windows 10 version 1903 or later, enrolled in Intune via Microsoft Entra join or hybrid join.
- Vendor
- Microsoft
- Tested environment
- Verified against Microsoft Intune admin center documentation, July 2026.
- Administrator permissions required
- Backup required
Steps verified against current Microsoft Learn documentation for Intune Remediations, Platform Scripts, and Win32 app deployment.
Allow approximately 15 minutes to set up your first registry management deployment.
Warning: Backup your registry before deploying changes
Registry modifications can affect system stability and application behavior. Export a backup of the target registry keys using reg export or create a System Restore point on pilot devices before deploying scripts to production groups.
Warning: Test on a pilot group first
Always deploy registry modifications to a small test group before rolling out to all devices. Verify that applications and system components behave as expected after the registry changes are applied.
Note: Licensing requirements differ by method
Remediations require Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 licensing per Microsoft Learn. Platform Scripts and Win32 app deployment only require Intune Plan 1.
1Sign in to the Intune admin center and verify permissions
Confirm you have access to the scripting and remediations features before creating scripts.
intune.microsoft.com > Devices > Manage devices > Scripts and remediationsOpen your browser and navigate to intune.microsoft.com. Sign in with your Intune Administrator or Global Administrator credentials.
Once signed in, go to Devices > Manage devices > Scripts and remediations. You should see two tabs: Platform scripts and Remediations. If the Remediations tab shows a licensing verification notice, go to Tenant administration > Connectors and tokens > Windows data and confirm your licensing.
Expected result: You see the Scripts and remediations page with both Platform scripts and Remediations tabs available.
Note
If the Remediations tab is grayed out, your tenant may not have the required Windows Enterprise E3/E5 licensing. Platform Scripts remain available with Intune Plan 1.
2Create a detection script for registry compliance
Write a PowerShell detection script that checks whether the desired registry configuration exists.
Create a file called detect-registry.ps1. The detection script must exit with code 0 when compliant and code 1 when non-compliant. Include Write-Output for logging, as Intune captures this output in its reporting.
powershell.exe -ExecutionPolicy Bypass -File detect-registry.ps1Expected result: The script exits with code 0 when the registry key exists with the expected value, and code 1 otherwise.
Note
Detection scripts must output something via Write-Output, as empty output causes Intune to report an issue not found state. Always use try/catch blocks to handle errors gracefully.
3Create a remediation script for registry modifications
Write a PowerShell remediation script that creates or modifies registry keys when non-compliance is detected.
Create a file called remediate-registry.ps1. This script runs only when the detection script exits with code 1. Create the registry path if it doesn't exist, set the required values, and exit with code 0 on success. For HKCU registry keys, change the path prefix to HKCU:\. Keep HKLM and HKCU modifications in separate script packages.
Expected result: The script creates or updates the target registry keys and exits with code 0.
Note
Use New-ItemProperty with -Force to create or overwrite values. The -PropertyType parameter accepts DWord, String, ExpandString, Binary, MultiString, and QWord.
4Deploy scripts via Intune Remediations
Upload your detection and remediation scripts as a Remediation script package for continuous enforcement.
Intune admin center > Devices > Scripts and remediations > RemediationsIn the Intune admin center, navigate to Devices > Manage devices > Scripts and remediations. Select the Remediations tab, then click Create script package. Upload your detection and remediation scripts. Set Run this script using the logged on credentials to No for HKLM keys or Yes for HKCU keys. Set Run script in 64-bit PowerShell Host to Yes.
Expected result: The script package is created and ready for assignment under the Remediations tab.
Note
Remediations require Windows Enterprise E3/E5 or Microsoft 365 F3/E3/E5 licensing. Scripts must be UTF-8 encoded.
5Configure the schedule and assign to device groups
Set the enforcement schedule and target specific device groups.
Intune admin center > Remediations > AssignmentsOn the Assignments page, click Add group under Included groups and select your target device group. Under Excluded groups, add any groups that should skip this configuration. Configure the schedule to Daily or Hourly. Click Review + create to finalize.
Expected result: The Remediation script package is assigned to your target device group with a configured schedule.
Note
If a scheduled run is missed, the remediation runs when the device comes back online. You can have up to 200 script packages per tenant.
6Deploy a one-time registry change via Platform Scripts
Use Platform Scripts for registry modifications that only need to run once per device.
Intune admin center > Devices > Scripts and remediations > Platform scripts > AddNavigate to Devices > Manage devices > Scripts and remediations, select the Platform scripts tab, click Add and select Windows 10 and later. Upload your PowerShell script and configure execution context. Platform scripts run once when the device checks in with Intune and retry three times on failure.
Expected result: The Platform Script is deployed and runs on targeted devices at the next check-in cycle.
Note
Platform Scripts are included with standard Intune Plan 1 licensing. Scripts time out after 30 minutes.
7Package registry configuration as a Win32 application
Deploy registry settings through a Win32 app package for install-time configuration.
Intune admin center > Apps > All Apps > Add > Windows app (Win32)Download the Microsoft Win32 Content Prep Tool from github.com/microsoft/Microsoft-Win32-Content-Prep-Tool. Create an install.ps1 script, run IntuneWinAppUtil.exe to create the .intunewin package, then upload it in the Intune admin center under Apps > All Apps > Add > Windows app (Win32). Configure a registry detection rule to verify successful deployment.
IntuneWinAppUtil.exe -c C:\IntuneApps\RegistryConfig -s install.ps1 -o C:\IntuneApps\OutputExpected result: The Win32 app is uploaded and deployed. Registry keys are created on target devices after sync.
Note
Win32 app detection rules can check for registry key existence, file existence, or MSI product codes.
8Monitor compliance and troubleshoot deployment issues
Verify registry configurations are applied correctly and resolve common issues.
Intune admin center > Devices > Scripts and remediationsFor Remediations, review the Device status tab. For Platform Scripts, check Monitor > Device status. For Win32 apps, check Apps > All Apps > your app > Device install status. To troubleshoot, check the Intune Management Extension logs at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs on the device.
Get-ItemProperty -Path HKLM:\SOFTWARE\YourTargetPath | Format-ListExpected result: Device status shows Without issue, With issue, or Failed statuses.
Note
The Intune Management Extension log is the most detailed troubleshooting source. You can also run on-demand remediations from a device's page in the admin center.
How to Verify Your Registry Configurations Are Applied
Confirm configuration
After deploying your registry management scripts, confirm the configurations are applied correctly. The Intune admin center provides per-device reporting for all three deployment methods.
For Remediations, the Device status tab shows compliant devices, remediated devices, and failures. A healthy deployment shows most devices in Without issue or With issue states.
On individual devices, verify registry values using Get-ItemProperty in PowerShell or the Registry Editor. The Intune Management Extension logs provide detailed execution traces for debugging.
Choose the right method: Remediations for ongoing enforcement, Platform Scripts for one-time configurations, Win32 apps for application-specific registry settings.
Normal result: Device status shows Without issue or With issue. Registry keys exist with expected values.
Abnormal result: Devices showing Failed status. Common causes: incorrect execution context, permission issues, malformed scripts, or licensing not verified.
Without issue
Device compliant
Detection script found the registry configuration already in place.
With issue
Remediated successfully
Detection found missing values; remediation applied the correct configuration.
Failed
Script execution error
Check execution context, permissions, and the IME log.
Troubleshooting
Remediations tab is grayed out or shows license notice
Warning
Cause: Tenant hasn't completed Windows license verification or lacks required licensing.
Go to Tenant administration > Connectors and tokens > Windows data. Toggle the license confirmation to On and verify your tenant holds Windows Enterprise E3/E5, Education A3/A5, or equivalent Microsoft 365 bundles.
Registry keys not created on target devices
Warning
Cause: Wrong execution context. HKLM needs SYSTEM, HKCU needs User context.
For HKLM, set Run this script using the logged on credentials to No. For HKCU, set to Yes. To modify HKCU for all users from SYSTEM, enumerate user SIDs under HKU.
Detection always reports non-compliant
Warning
Cause: Exit code logic inverted or registry path doesn't match.
Verify exit 0 = compliant and exit 1 = non-compliant. Test locally. Check registry path uses PowerShell drive notation (HKLM:\ not HKLM\) and value names match exactly.
Platform Script doesn't re-execute after registry drift
Note
Cause: Platform Scripts run once per device by design.
Switch to Remediations for ongoing enforcement. They run on a schedule and re-apply fixes when drift is detected. Alternatively, use a Win32 app with registry detection so Intune reinstalls if detection fails.
Win32 app shows Not applicable or fails to install
Warning
Cause: Device not Entra joined or doesn't meet requirement rules.
Verify devices are Microsoft Entra joined or hybrid joined. Check app Requirement rules for OS version or architecture filters. The IME installs automatically when a Win32 app is assigned.
Frequently asked questions
Can Microsoft Intune directly edit Windows Registry keys like Group Policy?
No. Intune doesn't have a built-in registry editor like Group Policy Preferences. You need PowerShell scripts via Remediations, Platform Scripts, or Win32 apps. The Settings Catalog covers some configurations, but arbitrary registry paths require scripted approaches.
What's the difference between HKLM and HKCU execution contexts in Intune?
HKLM keys need SYSTEM context (Run as logged on credentials: No). HKCU keys need User context (set to Yes). Running HKCU as SYSTEM writes to the SYSTEM HKCU hive, not the user's. To modify all users' HKCU from SYSTEM, enumerate SIDs under HKU.
Do Remediations require special licensing beyond Intune Plan 1?
Yes. Per Microsoft Learn, Remediations require Windows Enterprise E3/E5 (in M365 F3/E3/E5) or Education A3/A5. Platform Scripts and Win32 apps are included with Intune Plan 1.
Which method should I use for ongoing registry enforcement?
Use Remediations. They pair detection with remediation scripts on a schedule, reapplying fixes when drift is detected. This is the closest equivalent to GPO policy refresh. Platform Scripts run only once.
How do I troubleshoot failed Intune script executions?
Check the IME log at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log. It contains script output, exit codes, and errors. Also check HKLM\SOFTWARE\Microsoft\IntuneManagementExtension\Policies using the policy ID from the admin center URL.
Conclusion
You now have three proven methods for managing Windows Registry keys through Microsoft Intune. Remediations offer continuous detection and enforcement on a schedule, closely replicating GPO refresh behavior. Platform Scripts handle one-time registry configurations without additional licensing. Win32 apps let you tie registry settings to application deployment with detection-based compliance.
Choose the method that fits your use case: Remediations for drift-prone settings, Platform Scripts for stable one-time changes, and Win32 apps for application-specific configurations.
Use Intune Remediations with paired detection and remediation PowerShell scripts for continuous registry enforcement, or Platform Scripts for one-time changes when migrating from Group Policy.
Microsoft Intune admin center > Devices > Manage devices > Scripts and remediationsSources4
