How to Restart Intune Management Extension Service: 5 Proven Methods

Your devices are showing a stale policy status, and the Intune console is reporting client health failures. Before you reboot the entire machine—and disrupt whatever your users are working on—there's a faster fix: restart the Intune Management Extension service.

I've lost count of how many times this single action has resolved what looked like a complex device management issue. In my years working with Microsoft Endpoint Manager, the IME service restart has been my first move in roughly 80% of troubleshooting scenarios. It's quick, it's safe, and it often saves you from a full device reboot.

This guide walks through five proven methods to restart the Intune Management Extension service, from the simple GUI approach to PowerShell automation. I'll also cover what to do when the service is stuck, not running, or eating your CPU—because let's be honest, that's usually why you're here.

---

What Is the Intune Management Extension Service and Why Does It Need Restarting?

The Role of IME in Microsoft Endpoint Manager

The Intune Management Extension (IME) is a Windows service that runs under the name IntuneManagementExtension. It's the workhorse behind several critical functions in Microsoft Endpoint Manager:

• Policy retrieval – It pulls down configuration profiles and compliance policies from Intune.
• Win32 app deployment – It handles the installation, update, and uninstall of Win32 applications.
• PowerShell script execution – It runs both proactive remediations and custom scripts.
• Compliance checks – It evaluates device health against your compliance policies.

There's a common point of confusion here. The Intune agent (the MDM client) and the IME service are two separate components. The MDM agent handles the core enrollment and device-level policy. The IME, on the other hand, is what Microsoft calls a "side-by-side" extension—it extends Intune's reach to things the MDM agent can't do on its own, like running scripts or deploying complex Win32 apps.

Think of it this way: the MDM agent is the foundation of your house, and the IME is the electrical wiring. When the wiring shorts out, you don't rebuild the house—you reset the breaker.

Common Scenarios That Require a Restart

Over the years, I've seen the same handful of symptoms pop up again and again. Here's a quick reference table:

---

5 Ways to Restart Intune Management Extension Service on Windows 10 and 11

Method 1: Using the Services Console (services.msc)

This is the most straightforward method, and it's what I recommend for single-device troubleshooting when you have admin rights.

1. Press Win + R to open the Run dialog.
2. Type services.msc and press Enter.
3. Scroll down to find IntuneManagementExtension in the list.
4. Right-click on it and select Restart.

![Services console with IntuneManagementExtension highlighted]

That's it. The service will stop and start within a few seconds. You'll see the Status column flicker from "Running" to blank and back to "Running" again.

One thing to note: if the service is already stopped, the Restart option will be grayed out. In that case, you'll need to click Start instead.

Method 2: Restart via PowerShell (Restart-Service Cmdlet)

For those of us who prefer the command line—or need to script this across multiple devices—PowerShell is the way to go.

First, open PowerShell as Administrator. Right-click the PowerShell icon and select Run as administrator.

Before restarting, it's good practice to check the current status:

Get-Service -Name IntuneManagementExtension

This will show you whether the service is running, stopped, or stuck in a transitional state. Then, to restart:

Restart-Service -Name IntuneManagementExtension -Force

The -Force parameter is important here. Without it, PowerShell will prompt you if there are any dependent services. In my experience, the IME doesn't usually have dependencies that cause issues, but the -Force flag ensures a clean restart without prompts.

I've used this method in countless automation scripts. It's reliable, and it gives you a clear success/failure output that you can log.

Method 3: Using Command Line (net stop / net start)

If you're working in a batch script or you're more comfortable with the classic command prompt, the net commands work just fine:

net stop IntuneManagementExtension && net start IntuneManagementExtension

The && operator ensures the second command only runs if the first one succeeds. This is particularly useful in batch scripts where you want to avoid errors from trying to start an already-running service.

You'll need an elevated command prompt for this—right-click Command Prompt and select Run as administrator.

One caveat: the net stop command can hang if the service is stuck in a "Stopping" state. If that happens, you'll need to kill the process first (more on that in the troubleshooting section).

Method 4: Restart via Intune Portal (Remote Action)

This method is different from the others because it restarts the entire device, not just the IME service. But it's worth mentioning because it's the only option when you're managing devices remotely and don't have direct access.

1. Log in to the Microsoft Intune admin center.
2. Navigate to Devices > All devices.
3. Select the device you want to restart.
4. Click Restart in the toolbar.
5. Confirm the action when prompted.

![Intune portal remote actions menu with Restart highlighted]

The device will reboot, and the IME service will start fresh on boot—assuming it's configured to start automatically, which it should be by default.

I'll be honest: I use this method sparingly. Rebooting a user's machine is disruptive, and it's usually overkill for an IME issue. But if the service is completely broken and won't start, a reboot might be the fastest path to recovery.

Method 5: Trigger IME Sync Without Restarting (URL Moniker)

This is my favorite trick, and it's one that many IT admins don't know about. Instead of restarting the service, you can trigger a sync using a URL moniker. This is a non-disruptive alternative that's ideal for production environments where you want to avoid any service interruption.

From the Run dialog (Win + R), type:

intunemanagementextension://syncapp

Press Enter, and the IME will immediately check in with Intune for new policies and app assignments.

You can also trigger this from PowerShell:

$Shell = New-Object -ComObject Shell.Application
$Shell.open("intunemanagementextension://syncapp")

I discovered this method while digging through the IME executable with Sysinternals' Strings tool, and it's been a game-changer. Instead of restarting the service—which kills any in-progress operations—you're just telling the service to do its job right now.

There's also a compliance-specific variant: intunemanagementextension://synccompliance. This triggers a compliance check without a full policy sync.

---

How to Fix Intune Management Extension Not Working: Troubleshooting Guide

Sometimes a simple restart isn't enough. The service won't start, or it starts and immediately crashes, or it's running but eating 50% of your CPU. Here's how I approach these situations.

IME Service Stuck on 'Starting' or 'Stopping'

This is one of the most frustrating issues because the service appears to be in limbo. The standard restart commands won't work because Windows thinks the service is still transitioning.

Here's what I do:

1. Check the logs first. Navigate to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log. Look for error codes or repeated warnings around the time the service got stuck.

2. Kill the process. Open Task Manager, find Microsoft.Management.Services.IntuneWindowsAgent.exe, and end the process. Alternatively, use PowerShell:

   Stop-Process -Name Microsoft.Management.Services.IntuneWindowsAgent -Force
   

3. Restart the service. Once the process is dead, the service should show as "Stopped." Now you can start it normally.

4. Check for conflicts. If this keeps happening, look for third-party security software that might be interfering. I've seen antivirus products block the IME from writing to its own directories, which causes the service to hang.

A sample log entry that indicates trouble might look like this:

[Error] Failed to process policy. Error: Access denied. Path: C:\ProgramData\Microsoft\IntuneManagementExtension\Cache

If you see access-related errors, check the permissions on the C:\ProgramData\Microsoft\IntuneManagementExtension folder.

IME Service Not Starting Automatically After Update

After a Windows update or an IME update, the service sometimes fails to start. Here's my checklist:

1. Verify the startup type. Open services.msc, right-click IntuneManagementExtension, select Properties, and confirm the Startup type is Automatic.

2. Check the service account. The service should run as Local System. If it's set to something else, that could cause startup failures.

3. Reinstall the IME client. If the service is missing entirely from services.msc, you'll need to reinstall. Run this command from an elevated prompt:

   "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe" /Uninstall
   

   Then trigger a sync from the Intune portal or wait for the next scheduled check-in. The IME will reinstall automatically.

Here's a table of common error codes you might see in the Event Log:

IME Service High CPU Usage

A stuck sync loop is the usual culprit here. The IME keeps trying to process something—often a corrupted cache entry—and it spins its wheels.

My fix:

1. Stop the service.
2. Clear the cache folder. Delete the contents of C:\ProgramData\Microsoft\IntuneManagementExtension\Cache.
3. Restart the service.

If the problem persists, a full reinstall of the IME agent is the next step. I've seen corrupted cache entries survive a service restart but not a reinstall.

---

How to Restart Intune Management Extension Without Admin Rights

This is a scenario that comes up more often than you'd think. Standard users don't have the rights to restart services, but they're the ones staring at a device that's not getting its policies.

Using Intune to Push a Restart Script

The only viable method for standard users is to have Intune do the work for you. You can deploy a PowerShell script through Intune that restarts the service.

Here's a sample script:

Restart-Service -Name IntuneManagementExtension -Force

In the Intune admin center, go to Apps > Windows > Add > Windows app (Win32) or use the Scripts and remediations feature. Deploy the script to the affected devices, and Intune will run it with system privileges.

I've used this approach for fleet-wide IME resets. It's not instant—the script runs at the next check-in—but it's the only way to handle this without local admin rights.

Triggering a Sync via Company Portal

For a less invasive option, users can trigger an IME sync themselves through Company Portal:

1. Open Company Portal.
2. Click Settings in the sidebar.
3. Click Sync.

![Company Portal settings with Sync button highlighted]

This doesn't restart the service, but it forces the IME to check for new policies. In many cases, that's all you need. I've had users report that a stuck app installation started working right after they hit that Sync button.

---

IME Service Restart: What to Expect and How to Verify Sync Success

How Long Does It Take for IME to Sync After a Restart?

In my experience, a sync typically completes within 5 to 15 minutes after the service restarts. The actual time depends on several factors:

• Network speed and latency
• The number of policies and app assignments
• Device load and available resources

If you need an immediate sync, use the URL moniker method I described earlier (intunemanagementextension://syncapp). That triggers an instant check-in without waiting for the scheduled interval.

How to Check IME Service Status and Logs

After restarting the service, verify that everything is working:

1. Check the service status:

   Get-Service -Name IntuneManagementExtension
   

   The Status should show as "Running."

2. Review the logs. Open C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log and look for a message like:

   [Info] Sync completed successfully.
   

3. Check the Intune portal. Go to Devices > All devices and select the device. The Last check-in time should update within 15 minutes of the restart.

---

Frequently Asked Questions

What is the Microsoft Intune Management Extension service?

The Intune Management Extension is a Windows service that runs in the background on Intune-managed devices. It handles Win32 app deployments, PowerShell script execution, and compliance checks. It's a critical component of Microsoft Endpoint Manager's device management capabilities.

My Intune Management Extension is stuck on 'starting.' How can I fix this?

First, check the IME logs at C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log for errors. Then, kill the process (Microsoft.Management.Services.IntuneWindowsAgent.exe) via Task Manager or PowerShell, and restart the service. If the issue persists, check for conflicting third-party security software or consider reinstalling the IME agent.

Can I delete the Microsoft Intune management extension?

It's not recommended. The IME is essential for Intune management—deleting it will break Win32 app deployments, PowerShell scripts, and compliance checks. If the extension is corrupted, the correct approach is to reinstall it, not delete it.

How to reinstall Microsoft Intune management extension?

Run the uninstall command: "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe" /Uninstall. Then trigger a device sync from the Intune portal or wait for the next scheduled check-in. The IME will reinstall automatically.

Is it safe to restart the Intune Management Extension service?

Yes, it's safe and a common troubleshooting step. The service will temporarily interrupt policy sync and app deployments, but it will resume automatically. In-flight operations may be interrupted, so it's best to do this during maintenance windows if possible.

---

Conclusion

Restarting the Intune Management Extension service is one of those simple fixes that solves a surprising number of problems. Whether you're dealing with stale policies, stuck app deployments, or high CPU usage, a service restart—or even just a forced sync—should be your first move.

Here's my advice for choosing the right method:

• Single device, you have admin rights: Use services.msc or PowerShell.
• Multiple devices, need automation: Use PowerShell or a batch script.
• Remote devices, no direct access: Use the Intune portal's restart action or deploy a script.
• Production environment, minimize disruption: Use the URL moniker to trigger a sync instead of a full restart.

After any restart, always verify the sync status. Check the service is running, review the logs for successful sync messages, and confirm the last check-in time in the Intune portal.

Bookmark this guide for your next Intune troubleshooting session. If you found it helpful, share it with your IT team or leave a comment below with your experience—I'd love to hear what methods work for you.