Microsoft Intune

Overview

Run the Novageness installer on a schedule with Intune Remediations.

Remediations requires Windows Enterprise E3 or E5, included in Microsoft 365 E3, E5 and F3. Without it, use the scheduled task below.

Deploy Python 3 as a Win32 app with InstallAllUsers=1 PrependPath=1 Include_launcher=1. A per-user install will not be found.

Allow HTTPS to novageness.com, backend.novageness.com, api.novageness.com, raw.githubusercontent.com and github.com.

1. Get your API key

Open Configure and copy the key from the API Access panel.

2. Create the detection script

Save this as Detect_Novageness.ps1:

$base = 'C:\Program Files\Novageness'
$marker = Join-Path $base 'last-success.txt'
$owned = (Test-Path $marker) -and
    ((Get-Acl $base).GetOwner([Security.Principal.SecurityIdentifier]).Value -in @('S-1-5-18', 'S-1-5-32-544'))
if ($owned -and ((Get-Date) - (Get-Item $marker).LastWriteTime).TotalHours -lt 20) {
    Write-Output "Novageness: ran $((Get-Item $marker).LastWriteTime)"; exit 0
}
Write-Output "Novageness: needs a run"; exit 1

3. Create the remediation script

Save this as Remediate_Novageness.ps1, replacing YOUR_ADMIN_API_KEY with your key:

$base = 'C:\Program Files\Novageness'
New-Item -ItemType Directory -Force -Path $base | Out-Null
icacls $base /setowner '*S-1-5-32-544' /T /C | Out-Null
icacls $base /reset /T /C | Out-Null
icacls $base /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
$acl = Get-Acl $base
$allowed = @('S-1-5-18', 'S-1-5-32-544')
if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed -or
    ($acl.Access | Where-Object {
        $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -notin $allowed })) {
    throw "Could not secure $base. Refusing to continue."
}
Remove-Item (Join-Path $base '*') -Force -Recurse -ErrorAction SilentlyContinue

$installer = Join-Path $base 'onboard.ps1'
Invoke-WebRequest -Uri '/setup/mdm/windows/onboard' -OutFile $installer -UseBasicParsing -ErrorAction Stop

& $installer -ApiKey 'YOUR_ADMIN_API_KEY' -Backfill
$code = $LASTEXITCODE

if ($code -eq 0) {
    try { Set-Content -Path (Join-Path $base 'last-success.txt') -Value (Get-Date -Format 'o') -ErrorAction Stop }
    catch { Write-Output "Installed, but could not write the marker. $_"; $code = 1 }
}
Remove-Item $installer -Force -ErrorAction SilentlyContinue
exit $code

The folder sits under C:\Program Files, which standard users cannot write to, and is locked to SYSTEM and administrators. Nothing can be planted there ahead of the script. -Backfill imports past GitHub Copilot, Claude Code and Codex sessions. Re-running never duplicates a session.

4. Create the package in Intune

Go to Devices → Manage devices → Scripts and remediations → Remediations → Create script package.

Upload the scripts

Name the package Novageness daily onboard and upload both files as UTF-8 without a BOM.

Set the options

Run using logged-on credentials: No. Enforce signature check: No. Run in 64-bit PowerShell: Yes.

Assign and schedule

Assign to your developer device group and set the schedule to Daily.

To run it on one device now, open that device in Intune and choose Run remediation.

Verify

Intune

Device status shows Without issues.

Device

C:\Program Files\Novageness\last-success.txt updates daily.

Novageness

Devices appear with a recent last-seen time.

Troubleshooting

Symptom	Fix
`Python 3 is required but not found in PATH`	Re-deploy Python with `InstallAllUsers=1 PrependPath=1`, then reboot.
Remediation shows Failed	Open the device in Intune and read the output. It names the step that failed.
Copilot rows show `auto`	Allow one daily cycle. Sessions VS Code has already rotated cannot be read.

No Remediations licence

Deploy this once as a Platform script, run as SYSTEM in 64-bit. The task script holds your API key, so it lives under C:\Program Files, which standard users cannot write to, locked to SYSTEM and administrators.

Scheduled task script

$base = 'C:\Program Files\Novageness'
New-Item -ItemType Directory -Force -Path $base | Out-Null
icacls $base /setowner '*S-1-5-32-544' /T /C | Out-Null
icacls $base /reset /T /C | Out-Null
icacls $base /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' | Out-Null
$acl = Get-Acl $base
$allowed = @('S-1-5-18', 'S-1-5-32-544')
if ($acl.GetOwner([Security.Principal.SecurityIdentifier]).Value -notin $allowed -or
    ($acl.Access | Where-Object {
        $_.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value -notin $allowed })) {
    throw "Could not secure $base. Refusing to write the API key."
}
Remove-Item (Join-Path $base '*') -Force -Recurse -ErrorAction SilentlyContinue
$runner = Join-Path $base 'run-novageness.ps1'

@'
$installer = 'C:\Program Files\Novageness\onboard.ps1'
Invoke-WebRequest -Uri '/setup/mdm/windows/onboard' -OutFile $installer -UseBasicParsing -ErrorAction Stop
& $installer -ApiKey 'YOUR_ADMIN_API_KEY' -Backfill
$code = $LASTEXITCODE
if ($code -eq 0) {
    try { Set-Content -Path 'C:\Program Files\Novageness\last-success.txt' -Value (Get-Date -Format 'o') -ErrorAction Stop }
    catch { Write-Output "Installed, but could not write the marker. $_"; $code = 1 }
}
Remove-Item $installer -Force -ErrorAction SilentlyContinue
exit $code
'@ | Set-Content -Path $runner -Encoding UTF8

$action    = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument "-NoProfile -ExecutionPolicy Bypass -File `"$runner`""
$trigger   = New-ScheduledTaskTrigger -Daily -At 9:00am
$settings  = New-ScheduledTaskSettingsSet -StartWhenAvailable -RunOnlyIfNetworkAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 2)
$principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
Register-ScheduledTask -TaskName 'Novageness Daily Onboard' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force -ErrorAction Stop | Out-Null
Start-ScheduledTask -TaskName 'Novageness Daily Onboard' -ErrorAction Stop

Remove it with Unregister-ScheduledTask -TaskName 'Novageness Daily Onboard' -Confirm:$false.

Remove Novageness

Run the installer with -Clear in an elevated PowerShell, then delete C:\Program Files\Novageness.

Tamper Resistance

Best practices for keeping Novageness active on every device with managed settings.

Getting Started

CLI

Policies

Analytics

Hooks API

Integrations

MDM Integrations

Connections

Support & Troubleshooting

Overview

1. Get your API key

2. Create the detection script

3. Create the remediation script

4. Create the package in Intune

Verify

Intune

Device

Novageness

Troubleshooting

No Remediations licence

Remove Novageness

Tamper Resistance

​Overview

​1. Get your API key

​2. Create the detection script

​3. Create the remediation script

​4. Create the package in Intune

​Verify

Intune

Device

Novageness

​Troubleshooting

​No Remediations licence

​Remove Novageness

Tamper Resistance

Overview

1. Get your API key

2. Create the detection script

3. Create the remediation script

4. Create the package in Intune

Verify

Troubleshooting

No Remediations licence

Remove Novageness