#Requires -Modules @{ ModuleName = 'Pester'; ModuleVersion = '6.2.0' }

<#

Template for testing a folder of Intune scripts with IntuneScriptLab. Copy it next to your

scripts as IntuneScripts.Tests.ps1, adjust the paths, run Invoke-Pester.

Layout it assumes:

.\Remediations\<Package>\Detect.ps1 and Remediate.ps1

.\Win32\<App>\Detect.ps1 and Package\ (the content that becomes the .intunewin), and for an

app detected by portal rules instead of a script, Rules.psd1 holding

@{ DetectionRules = @(@{ Type = 'File'; ... }); UninstallCommand = '...' }

.\PlatformScripts\*.ps1

Static checks run anywhere. The runtime checks start real Windows PowerShell 5.1 processes

and need Windows; -Context System additionally needs a session that can register a

scheduled task as SYSTEM (elevated).

A folder you do not have (no Win32 apps yet, say) yields an empty -ForEach, which Pester 6

treats as a discovery failure. -AllowNullOrEmptyForEach on each block turns that into

"nothing to test" instead; delete the switch where the folder must never be empty.

#>

BeforeAll {

Import-Module IntuneScriptLab

$script:IsAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).

IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

# The device's 64-bit host, for the WOW64 comparison: x64 on x64, arm64 on Windows on ARM

$script:Host64 = if ("$([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture)" -eq 'Arm64') {

'arm64'

}

else { 'x64' }

}

Describe 'Static analysis' -Tag 'Static' {

It 'has no warnings or errors: <_.Directory.Name>/<_.Name>' -AllowNullOrEmptyForEach -ForEach (

Get-ChildItem "$PSScriptRoot\Remediations" -Recurse -Filter *.ps1 -ErrorAction SilentlyContinue) {

# Detection/Remediation is inferred from the file name; use -ScriptType or a directive

# comment in the script if your names differ (see the README)

$_ | Should-PassIntuneAnalysis

}

It 'survives the stdout/stderr rules: <_.Directory.Name>/<_.Name>' -AllowNullOrEmptyForEach -ForEach (

Get-ChildItem "$PSScriptRoot\Win32" -Recurse -Filter Detect.ps1 -ErrorAction SilentlyContinue) {

$_ | Should-PassIntuneAnalysis -ScriptType Win32Detection

}

}

Describe 'Remediation packages' -Tag 'Runtime' {

Context '<_.Name>' -AllowNullOrEmptyForEach -ForEach (

Get-ChildItem "$PSScriptRoot\Remediations" -Directory -ErrorAction SilentlyContinue) {

It 'runs the detection cleanly in the 32-bit host' {

$result = Invoke-IntuneRemediationTest -DetectionPath "$($_.FullName)\Detect.ps1" -Architecture x86

($result.Status -in 'Without issues', 'Issue detected (no remediation script)') | Should-BeTrue

@($result.Warnings).Count | Should-Be 0

}

It 'reports the same in the 64-bit host (no WOW64 dependence)' {

# The 64-bit host is the device's own: x64 on x64, arm64 on Windows on ARM, where an

# explicit x64 is refused (the agent runs the native 64-bit host there too)

$detect = "$($_.FullName)\Detect.ps1"

$x86 = Invoke-IntuneRemediationTest -DetectionPath $detect -Architecture x86

$x64 = Invoke-IntuneRemediationTest -DetectionPath $detect -Architecture $script:Host64

$x64.PreDetection.ExitCode | Should-Be $x86.PreDetection.ExitCode

}

# Only where the remediation is safe to run on the test machine

It 'fixes the issue as SYSTEM' -Skip:(-not $script:IsAdmin) {

$intuneRemediationTestSplat = @{

DetectionPath = "$($_.FullName)\Detect.ps1"

RemediationPath = "$($_.FullName)\Remediate.ps1"

Context = 'System'

}

Invoke-IntuneRemediationTest @intuneRemediationTestSplat |

Should-HaveIntuneStatus 'Fixed'

}

}

}

Describe 'Win32 apps' -Tag 'Runtime' {

Context '<_.Name>' -AllowNullOrEmptyForEach -ForEach (

Get-ChildItem "$PSScriptRoot\Win32" -Directory -ErrorAction SilentlyContinue) {

It 'is not detected before install' {

Invoke-IntuneDetectionTest -Path "$($_.FullName)\Detect.ps1" | Should-NotBeIntuneDetected

}

# Only where the app has a PowerShell requirement rule; mirror the rule configured in the portal

It 'meets its requirement rule' -Skip:(-not (Test-Path "$($_.FullName)\Requirement.ps1")) {

Invoke-IntuneRequirementTest -Path "$($_.FullName)\Requirement.ps1" -OutputType String -Value 'ok' |

Should-BeIntuneApplicable

}

It 'installs and is then detected' -Skip:(-not $script:IsAdmin) {

$intuneWin32AppTestSplat = @{

DetectionPath = "$($_.FullName)\Detect.ps1"

ContentPath = "$($_.FullName)\Package"

InstallCommand = 'powershell.exe -ExecutionPolicy Bypass -File install.ps1'

Context = 'System'

}

Invoke-IntuneWin32AppTest @intuneWin32AppTestSplat |

Should-HaveIntuneStatus 'Installed after install'

}

# Only where the app is detected by file, registry or MSI rules: mirror the portal rules in

# Rules.psd1; all of them must be met, as under the agent

It 'meets every detection rule after install' -Skip:(-not ($script:IsAdmin -and

(Test-Path "$($_.FullName)\Rules.psd1"))) {

$rules = Import-PowerShellDataFile "$($_.FullName)\Rules.psd1"

$intuneWin32AppTestSplat = @{

DetectionRule = $rules.DetectionRules

ContentPath = "$($_.FullName)\Package"

InstallCommand = 'powershell.exe -ExecutionPolicy Bypass -File install.ps1'

Context = 'System'

}

Invoke-IntuneWin32AppTest @intuneWin32AppTestSplat |

Should-HaveIntuneStatus 'Installed after install'

}

It 'uninstalls and is no longer detected' -Skip:(-not ($script:IsAdmin -and

(Test-Path "$($_.FullName)\Rules.psd1"))) {

$rules = Import-PowerShellDataFile "$($_.FullName)\Rules.psd1"

$intuneWin32AppTestSplat = @{

DetectionPath = "$($_.FullName)\Detect.ps1"

ContentPath = "$($_.FullName)\Package"

Intent = 'Uninstall'

UninstallCommand = $rules.UninstallCommand

Context = 'System'

}

Invoke-IntuneWin32AppTest @intuneWin32AppTestSplat |

Should-HaveIntuneStatus 'Uninstalled'

}

}

}

Describe 'Platform scripts' -Tag 'Runtime' {

It 'succeeds: <_.Name>' -AllowNullOrEmptyForEach -ForEach (

Get-ChildItem "$PSScriptRoot\PlatformScripts" -Filter *.ps1 -ErrorAction SilentlyContinue) {

Invoke-IntunePlatformScriptTest -Path $_.FullName | Should-HaveIntuneRunState 'Success'

}

}