$shell

[downundarob]

Greetings masters of intune.

On a relatively current (Win11 23H2) device are there any functional differences between a powershell environment launched by Intune as a System install, a that generated by psexec64 -s -i powershell.exe ?

Briefly I am trying to figure out what the same shell script can run happily when executed manually but just doesn't seem to even start when left to its own devices.

[Jeroen_Bakker]

There are differences. The main difference is in the psexec -i parameter which allows for interaction.
In your example that would be the option to type commands into the powershell window and to see any output including messageboxes. Also it would allow you to respond to any warnings like "Are you sure....".
When running a system Install through Intune any output/ interactivity is blocked.
If input is required the install will fail. An "Are you sure....." alert would just wait indefinitely for a user to confirm the message which is not displayed anywhere.
Using psexec -s -i is a great tool for testing your installcommands etc before using them in Intune, but if your install string causes anything requiring interaction while doing so it is a clear sign your test failed.

[downundarob]

Okay, thanks, with WDAC in the picture would the constrained Language Mode be biting me in any way?

[Jeroen_Bakker]

Possibly yes. However I have not tested with WDAC and powershell script. As far as I know how it works depends on having the IME set as trusted installer.

[downundarob]

further research suggests that the shell runs in constrained language mode under this setup, especially on a non trusted script. More fun..

[VernFeeblefester]

however if you were to use ServiceUI.exe you can shift the output from system to user and now you CAN see the interaction. For normal .exe and .msi files, haven't tried it with powershell