Intune Remediation script to uninstall 7-Zip

Question

I just wanted to have some advice on those remediation scripts; what do you think?

The idea is to detect every 7-Zip installed on the computer and search for those not up to date and uninstall them. Got some Struggle with placing correctly the exits code used by Intune.

Detection Script:

$64bits = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match "7-Zip"
$32bits = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match "7-Zip"

if (!($64bits) -and !($32bits)){
    Write-Host "7-Zip isnt detected at all"
    exit 0
}

if ($64bits){
    foreach ($soft in $64bits){
        Write-Host "7-Zip(x64) ver:" $soft.DisplayVersion "detected"
        if ($soft.DisplayVersion -lt "23.01"){
            exit 1
        }
    }
}
else {
    Write-Host "7-Zip(x64) isnt detected"
}

if ($32bits){
    foreach ($soft in $32bits){
        Write-Host "7-Zip(x86) ver:" $soft.DisplayVersion "detected"
        if ($soft.DisplayVersion -lt "23.01"){
            exit 1
        }
    }
}
else {
    Write-Host "7-Zip(x86) isnt detected"
}

Remediation Script:

$64bits = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match "7-Zip"

if ($64bits){
    foreach ($soft in $64bits){

        if ($soft.DisplayVersion -lt "23.01"){
            
            Write-host "Uninstall" $soft.DisplayName $soft.DisplayVersion
            Start-Process $soft.UninstallString -ArgumentList "/S"
        }
    }
}
$32bits = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -match "7-Zip"

if ($32bits){

    foreach ($soft in $32bits){

        if ($soft.DisplayVersion -lt "23.01" -or $soft.DisplayVersion -eq $null){
            Write-Host "7-Zip(x86) ver:" $soft.DisplayVersion "detected"

            Start-Process $soft.UninstallString -ArgumentList "/S"
            Write-host "Uninstall" $soft.DisplayName $soft.DisplayVersion
        }
    }
}
exit 0

Answer 1

Some quick and superficial comments:

Some constants like $64bits and $32bits should be defined once. It makes sense to put them in a separate file and include the file in your script.

Here is an example of how you could load (include) files residing in your script directory.

Better yet, create a Powershell module. The script could be much more versatile and be used for other programs as well. Then, consider using a parameter to pass the program name from the command line.

In a corporate environment, I think a group policy of some sort would be the chosen route for maintaining software on the workstations. I noticed that you mentioned Intune.

The software version is hardcoded multiple times. It shouldn't. This should be a parameter, because the value will change over time. You don't want to change your code every time there is an upgrade.

There is unneeded duplication, the loops for $64bits and $32bits are functionally identical. You just need one additional nested ForEach loop and you can reduce the size of the code by an half.

exit 0 isn't really needed, it is implicit.

But it would really make sense to check the exit code after running Start-Process (with -Wait), because the uninstalling could indeed fail.

I have noticed minor discrepancies in spelling like Write-Host vs Write-host, which makes me think that maybe you are not using an IDE (eg Visual Studio Code) at the moment, but a generic editor. If that is not the case I would recommend using an IDE + some plugins for code completion, formatting, syntax checking etc.

I have not tested this script, being on Linux at the moment.

I think there is one thing that is problematic, it is that you are uninstalling software that is not up to date, which is bound to cause loss of functionality and frustration among end users. The proper remediation should be to upgrade the software to the latest stable release, not remove it unless it is not in your approved list. Or unless you can guarantee that another mechanism (Intune?) is already taking care of that.