Proactive Remediations – Getting your message across with repeated Toast Notifications

Getting your message across

Sometimes you just need to get your message across

We have seen many great community solutions built around the Toast Notification framework. Notifying users of impending actions and faults is key to keeping them engaged and interested in the health and longevity of their devices. Maurice Daley has written some great blog posts on Proactive Remediations lately and his solutions often display a Toast Notification to users to let them know “what is going on” – check out his recent post on Proactive Hard Drive Replacement with Endpoint Analytics

I’ll Toast to that

A while back I put together a Toast Notification solution that would allow you to notify users of “impending” actions that would affect them. Toast Notify is available on my GitHub, grab it before it gathers more dust byteben/Toast (

Just recently we had a customer who wanted to notify their users of a Feature update that was being rolled out that afternoon. In spite of best efforts, well coordinated communications and weeks of planning they knew that some people would “forget the memo” and switch their devices off as they left for the day.

We knew that Toast Notifications would be ideal for that “Just in Time” reminder. But why stop at just one notification? What if the user just dismissed the notification without paying too much attention – all that effort of popping a Toast Notification and it just got ignored.

Spreading on some Jam

So this idea of popping more than one Toast was intriguing. I adapted the Toast script a while ago to accommodate it being delivered/run in the SYSTEM context – we know that Toast Notifications must be popped in the USER context. I took the idea from Cody Mathis over at Patch My PC (Thanks Cody) to run the Scheduled Task as the “USERS” account when the script was delivered in the SYSTEM context. It works pretty well.

The Scheduled Task had a single trigger which would re-run the script in the context of the logged on user

Scheduled Task will run for the logged on user

Getting Trigger Happy

Going back to our original scenario, we want to pop the same Toast multiple times to “Get the message across”. Obviously you need to make sure this would be practical – the sales exec might not appreciate multiple Toasts popping during a PowerPoint sales pitch. But this blog is all about shouting your message from the roof tops – so lets continue. In our script we can define multiple triggers in a scheduled task to ensure out Toast pops multiple times. We accommodate this by allowing the script admin to enter an array of times when they want the trigger to fire

Array of times for the Scheduled Task Triggers
Triggers all set to pop the Toast Notification

We simply pulled the $ToastTimes array members into our Scheduled Task creation script – pretty neat

Proactive Remediations

So how do we deliver this script? Proactive Remediations of course! There was a challenge here. We had the day and times that these Toast notifications needed to pop from the customer. How could we ensure the Proactive Remediation would remediate (deliver the script) on time? We didn’t want users to get the Toast the following day AFTER the Feature Update was delivered to them.

This is where you can get a little creative with your scripts. In order to remediate the device (create a scheduled task to pop our Toast), the detection script must exit with an Exit Code of “1” – the device is “Not Complaint”. If the detection script exits with an Exit Code of “0” the device is marked as “Compliant” and the remediation script will not run.

In our detection script, we do two things. If the client date does not match the date we intend the toasts to pop – we exit the script with an Exit Code of “0” (Do not remediate). If the script has run before (flagged by a registry value that gets added when the remediation script runs) we also exit the script with an Exit Code of “0”. If the client date matches the date in the detection script and the remediation script has not run before – we exit with an Exit Code of “1” – which means remediate.

Remediate if the client date matches and remediation hasn’t occurred previously

Putting the pieces together

“Script Changes are Required”


You need to adjust the $Targetdate variable in line 5. The date should reflect when you want the scheduled task to run on the users device. Planning is key. Make sure you assign the Proactive Remediation giving enough time for your device to check in and run the remediation script “before” the scheduled task is triggered to run.

$TargetDate = (Get-Date -Day 24 -Month 5 -Year 2021).ToString(“ddMMyyy”)


You will need to adjust the $ToastTimes array on line 24. The array members should be the times you want multiple triggers creating in the scheduled task

$ToastTimes = @(“15:00”, “16:00”, “17:00”)



Proactive Remediation

  1. In the MEM Admin Centre, navigate to Reports > Endpoint analytics and click Create script package
Create a Proactive remediation

2. Enter a Name and click Next

Enter a script name

3. Select you Detection and Remediation script and toggle to Run script in 64-bit PowerShell and select Next

Upload your scripts

4. On the Assignments blade, select the group of devices to deploy the scrips to

5. Edit the proactive remediation schedule. Click the 3 dots and choose Edit

6. Select Once from the Frequency list and choose the appropriate date to run the proactive remediation. The date should match the same date you specified in your detection script

Tip: Select a time well in advance of the trigger times in the scheduled task

7. Click Next and Create


Monitor the Proactive Remediation

On the client a scheduled task is created with the triggers you specified.

A registry value is also added to satisfy the proactive remediation detection method

Toast Notifications will pop at the trigger intervals you specified


This was a pretty specific use case where the customer wanted multiple toast notifications to occur at specific times of the day to remind users to leave their computers on.

I don’t expect you to have the exact same requirement but I wanted to highlight how versatile Proactive Remediations are. I really like that we can fire the same toast notification multiple times to “get our message across” by creating multiple triggers in our Toast Notification scheduled task. If the user dismisses the first notification the next trigger will fire a new notification to reinforce your message.

Let me know how you are using proactive remediations in your environment!

Thanks to Maurice for previously tweaking the toast notification to pull the toast images from a URL – this makes the toast solution very versatile.

Thanks to Mark Stoop for making the photo for this blog available freely on @unsplash

Leave a Comment

Your email address will not be published.

Time limit is exhausted. Please reload CAPTCHA.


This site uses Akismet to reduce spam. Learn how your comment data is processed.