Download Intune PowerShell scripts

Choose the script type you actually need

Windows PowerShell scripts and remediations are separate object types in Intune and in a TenuVault backup. A Windows PowerShell script has one scriptContent field. A remediation has separate detectionScriptContent and remediationScriptContent fields. Recovering only the detection body does not recover the repair logic that ran when a device failed detection.

TenuVault also covers macOS shell scripts, macOS custom attributes and compliance scripts. Do not use their presence as evidence that the Windows script you need was captured: identify the type, name and saved date. Remediations provided by Microsoft are skipped; the remediation snapshots discussed here are for custom scripts.

Make a backup that includes the script bodies

Select the source tenant in TenuVault and open Backup & Restore, then Run Backup. In the Back up dialog, use Custom to expand Scripts and remediations and select the required types. Check the saved backup choice if you also want future automatic backups to preserve these types.

The backup reads each object in detail rather than saving only the list response. That matters for script content, which may not be supplied in a basic list result. Read the completed result and any type or item failures. An archive that contains a script name without a usable body does not give you the code back.

If you need a previous script version, use a backup from before the edit. Running a new backup captures the current object; it cannot reconstruct code that was overwritten before any snapshot existed. Keep the old backup until the recovered body has been inspected.

Download the saved snapshot

In Backup History, choose the dated backup in Backup Timeline. Open Backup Details and choose Download. Extract a working copy of the ZIP, then locate the PowerShellScripts or Remediations folder and the expected JSON object. Match the saved object ID as well as its display name when names have been reused.

The downloaded ZIP contains plain JSON, even if your backup storage is encrypted. Restrict access to both the archive and extracted files. TenuVault's download is a backup archive, not a dedicated export that writes a ready-to-run PowerShell file for every script. The broader format and archive checks belong in the export guide.

• Export Intune policies and backup archives

Decode content without running it

The script content fields use base64 encoding. Read the JSON as data, take the content string from the correct field and decode its bytes into a separate file. In PowerShell, Convert.FromBase64String converts that string to bytes, and IO.File.WriteAllBytes can write those bytes without executing the script.

Preserve the decoded bytes rather than assuming a text encoding and re-saving the script through a conversion that changes it. Open the recovered file in an editor for inspection. Base64 is an encoding, not encryption, and decoding it is a recovery step rather than a reason to run the code on your admin computer.

For a remediation, decode detection and remediation separately and give the working files distinct names. An empty remediation body is not repaired by copying the detection body into it. Check the source snapshot and the intended design before deciding whether the saved remediation actually included repair code.

Recover the operating settings as well as the text

The script body is only part of the object. Review its run context, signature requirements and other execution settings in the saved JSON before reusing it. Keep the assignment record alongside the code so you can distinguish recovering content from deploying that content to devices.

If your next task is to restore the script object, use TenuVault's reviewed restore workflow rather than treating the decoded file as a complete policy. Community can restore one item as an unassigned copy. Pro and MSP add the wider restore options; assignment restore remains a separate choice.

A backup snapshot is also not a log of every device execution. It tells you which code and configuration were saved at that point, not every device result or every intermediate script edit. Keep those operational records separately when investigating a remediation that behaved unexpectedly.

• Review the restore workflow

Script-content recovery checklist

Before reusing recovered code, compare it with the change record and test it in an appropriate pilot environment. This is particularly useful for a remediation whose detection and repair bodies were edited at different times: review them as a pair from the same saved snapshot.

• Record the source tenant, object identity, backup time and content fields decoded.
• Keep the original JSON and work on separate decoded files.
• Inspect both remediation bodies and execution settings before a pilot.
• Confirm intended targeting separately; downloading or decoding a file does not assign it.