Why Isn't Output Showing in the Activity Log for My Worklets?

Joshua

Updated: July 30, 2026 03:42

Worklet output can be missing for several different reasons, and they have different fixes. Work through the causes below in order, since the first two account for most cases.

Cause 1: the output stream does not match the exit condition

Output is captured from a different stream depending on whether the run succeeded or failed. If you write to the stream that does not match your exit code, the text is discarded.

Symptoms

echo "Software Not Found" or equivalent not appearing on a non-zero exit.
Write-Error "Software Not Found" or equivalent not appearing on a zero exit.

Resolution

Match the stream to the exit condition.

For output on a successful run (exit 0), write to standard output.
- PowerShell: Write-Output
- Bash: redirect to stdout if the output would not already go there, for example appending 2>&1
For output on a failed run (non-zero exit), write to standard error.
- PowerShell: Write-Error
- Bash: redirect to stderr if the output would not already go there, for example appending 1>&2

Prefer Write-Output over Write-Host in PowerShell. Write-Host targets the information stream rather than standard output, so it is less reliable for this purpose. If you are writing a script that should report either way, write the message to both streams, or write to standard output and use a non-zero exit only for genuine failures.

Cause 2: you are looking at the Activity Log, but the output is in the device logs

Evaluation code output does not appear in the main Activity Log. Evaluation runs as part of the device scan rather than as a policy execution, so the Activity Log shows only the remediation.

The evaluation output is still retrievable. Open the Device Details page and expand the Device Logs section beneath the Device Snapshot, which is collapsed by default and easy to miss. Two entries are relevant:

policy_#####_test contains the Evaluation Code output
policy_#####_remediation contains the Remediation Code output

where ##### is the policy ID. This is the fastest way to confirm whether your evaluation ran at all and what it returned.

Note that a manual run of a Worklet skips the Evaluation Code entirely and executes only the remediation, so a manual run will never produce evaluation output. See Why is the Evaluation Code Skipped When I Manually Run a Worklet?

Cause 3: the output is being swallowed by a 64-bit script block

Automox executes Worklet scripts in a 32-bit PowerShell context. Code that needs 64-bit PowerShell is normally wrapped in a script block and invoked through sysnative. Output from that separately invoked process is not captured automatically, so anything written inside the script block is lost unless it is allowed to flow back out of the call.

Two common mistakes:

Assigning the invocation to a variable, as in $exitCode = & "...powershell.exe" .... The call operator returns the command's output, so that variable captures your text instead of printing it. It also does not contain an exit code, despite the name commonly used for it.
Using -WindowStyle Hidden, which is unnecessary for a process with no interactive session and contributes to output not surfacing.

Let the call print, and propagate the exit code explicitly:

$scriptBlock = {
    Write-Output "Running in 64-bit context."
    exit 2
}

& "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" `
    -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command $scriptBlock

exit $LASTEXITCODE

If you would rather capture the output first, store it and then write it out, capturing the exit code immediately before any other command overwrites it:

$result = & "$env:SystemRoot\sysnative\WindowsPowerShell\v1.0\powershell.exe" `
    -ExecutionPolicy Bypass -NoProfile -NonInteractive -Command $scriptBlock
$code = $LASTEXITCODE

Write-Output $result
exit $code

Cause 4: the Details column is hidden in Policy Results

Per-device output is shown in the Details column of the Policy Results device table. That column can be turned off in the table's column settings, in which case you see only the high-level summary text for each device and none of the standard output.

If the summary is visible but the detail is not, check the column controls for the device table and confirm Details is enabled before concluding the output was never produced.

A note on exit code 124

Because of how PowerShell is launched for Worklets, an exit 1 frequently surfaces as Exit Code 124, COMMAND TIMED OUT, even when the script ran to completion and produced output. If you see a timeout alongside script output, the script finished and the exit code is what you are looking at, not a genuine timeout.

Using a different non-zero value such as exit 2 keeps real timeouts distinguishable from a normal non-compliant result.

Where to look, in order

Activity Log for remediation output on a policy run.
Device Details > Device Logs for policy_#####_test and policy_#####_remediation, which is the only place evaluation output appears.
Policy Results device table, with the Details column enabled, for per-device output across a run.

Was this article helpful?

0 out of 0 found this helpful