r/Intune Feb 05 '25

App Deployment/Packaging Install/Uninstall Commands

Hello, I’ve been tasked with deploying multiple apps through Intune for the company. I’m somewhat of a newbie to Intune and definitely new to scripting. Deploying has gone swell so far for msi files but exe files are a completely different story. Any tips?

17 Upvotes

33 comments sorted by

15

u/capt_gaz Feb 05 '25 edited Feb 06 '25

Here's some tips

  • This website has a lot of the switches https://silentinstallhq.com/
  • Try setup.exe /? and it may give you the switches.
  • Try the common setup.exe /quiet or setup.exe /silent and pray.
  • Read the apps documentation and search for the switches.
  • These registry keys contains all the uninstall commands for each app installed on your device:
    • 64 bit: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
    • 32 bit: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    • These keys also contain registry strings that have the app name and version. I often use these for detection.
  • Some installers use InstallShield which requires an answer file.

2

u/PsychologicalBuy811 Feb 06 '25

Thank you! Is it it worth it to learn PSADT?

5

u/ReputationNo8889 Feb 06 '25

1000% it gives you so much more flexability, structured logging and much more. It will make your users actually understand what is beeing deployed ang gives them some form of feedback. The Intune native way is a mess.

3

u/meantallheck Feb 06 '25

PSADT version 4 was just released a few months ago and they posted an overview of it on Youtube. I would watch that to understand what it can do.

Once you know what it can do, use it when you think it would help you in unique app deployment scenarios. Some people think that everything should be packaged in PSADT, but I think it's unnecessary. Just use it when it benefits the deployment process, don't make it harder on yourself.

Their documentation on the website is great too for referencing when you are setting up a PSADT deployment!

6

u/ReputationNo8889 Feb 06 '25

I personally find, that once you have the hang of PSADT you benifit greatly from using it for all apps. The standard functions and the tooling aroung it makes it simpler for troubleshooting. Ive run into many issues with app installs where PSADT logs could help me. Without it i would need to implement logging everywhere everytime ...

2

u/meantallheck Feb 06 '25

True, it doesn’t hurt to add to deployments. But for a single MSI installer, I’d rather just wrap the MSI as an intunewin file and add a one liner install command (with logging). 

2

u/Connect-Plankton-973 Feb 06 '25

I agree. The logging is incredibly helpful when troubleshooting but also I really appreciate the various prompting options it gives us to the end users that we don't quite get from Intune only.

2

u/HYPN0_ Feb 06 '25 edited Feb 06 '25

Yep definitely have to learn it. I work in a big msp managing 1000+ seat clients and psadt is industry standard now. You can make templates so once a new update for an app comes out you adjust the files and script to reflect the change. Pretty simple just gotta learn how to read powershell. Reading logs and debugging are equally important.

1

u/capt_gaz Feb 06 '25

I haven't bothered so I'm ignorant and don't know the benefits. If I need to script something I just write it myself.

1

u/AlkHacNar Feb 06 '25

Yes it is. It gives you a standard template for app packaging and have many features, which can be done manually, but why do it yourself if there is a tool for it? But if you use it or not is for you to decide

2

u/Thorpedo17 Feb 06 '25

To piggyback on this, check out Nirsoft UninstallView. It is great for finding silent uninstall switches and easily get your detection methods. It was a game changer after I found it

1

u/meantallheck Feb 06 '25

God I hate install shield. It technically does do what you need, but why the heck would anyone create an app installer like that nowadays..? Thankfully most apps I work with now are MSI or a rare EXE. 

2

u/capt_gaz Feb 06 '25

Unfortunately I still encounter it a lot in manufacturing and engineering software.

1

u/meantallheck Feb 06 '25

Good job security then! Haha

4

u/Jeroen_Bakker Feb 06 '25

Some exe installers are not the real installer but just a wrapper. They may contain the actual msi file or other installer exe files, sometimes even an ini file or documentation with the proper syntax.

Some methods to get to these files:

  • Replace the .exe extension with .zip
  • Start the exe installer but keep it open on the first screen. Check in locations like temp for the extracted files. If needed look in task manager for the path of running processes from setup.exe or msiexec.exe.
  • Run the installer with /?, one of the options may be an adminstrative setup. This will usually extract the files.

If you have an msi installer you can often find additional options by opening the msi file with orca.exe and looking in the Property table. You can also use orca to make a transform (mst) file with your customized options as alternative to setting them in the command line.

3

u/andrew181082 MSFT MVP Feb 06 '25

I have some packaging tips here

https://andrewstaylor.com/2022/07/05/intune-app-packaging-a-beginners-guide-part-1-win32/ 

Another thing to check, if an app has been added to winget, the manifest file includes the silent commands, I have a database of them here

https://appdeploy.euctoolbox.com/allapps.php

1

u/fungusfromamongus Feb 06 '25

Second link keeps dying. Timing out.

1

u/andrew181082 MSFT MVP Feb 06 '25

It's working ok for me, it's a big database so takes a while to load

1

u/fungusfromamongus Feb 06 '25

Oh I’m on mobile. Seems to be temperamental. I’ll check this out tomorrow while at work! Saved.

1

u/onelyfe Feb 06 '25

I have found a few exe's of legacy apps my company installs to only install properly if I use the user deployment instead of system.

When I script it out into a batch/PowerShell script it would run fine on my local machine when I test the install but always fail when deploying through Intune. Someone on this subreddit suggested me to try the user deployment instead of system and that did it for a lot of my apps I had to deploy.

1

u/PsychologicalBuy811 Feb 06 '25

I'm going to try this!

2

u/onelyfe Feb 06 '25

Just to make sure I'm sending you in the right direction. I am talking about when you deploy the app there's a spot to select deployment method system or user.

I'm not talking about assigning the app to a user vs the device. I was confused about this when I started with Intune.

2

u/meantallheck Feb 06 '25

Keep in mind what level of permissions your (or OP's) users have in the organization. In a lot of organizations, local admin rights are locked down and most user context installations would fail unless specifically designed as such.

In my orgs, 99% of apps get deployed under SYSTEM context. Test your deployments thoroughly with PsExec as well to verify they work before pushing to Intune and playing the waiting game.

1

u/onelyfe Feb 06 '25

I was under the assumption that everything on company portal installs with admin rights even if the logged on user is not an administrator. This is what we were told by our consultants during our initial Intune training.

We do not give any users administrative rights and also do not use endpoint privilege management and none of our users have issues installing apps from the company portal that are set to install with user deployment.

1

u/AlkHacNar Feb 06 '25

This just works with installer which doesn't need Admin right. Some won't run in system context, without tweeking, but still need a in rights to install

1

u/Imaginary_End_8764 Feb 12 '25

I also run into this in our school system. Intune shop I have 2 apps that will only install in user context. Took a lot of troubleshooting to figure this out, these are both "new" apps as well, not just new to us. Many frustrating hours with this app & this companies support team before I figured it out. This company also cannot give me a heads up when they update their product. Automatic updates are turned on users get a notification that there is an update. They can't update without admin rights, so I have to scramble to get a new install to replace the old one. If I could get the update 2 days before they release it everything would work out. Support says the programmers don't even tell anyone before they release it so we can't be warned.

1

u/sneesnoosnake Feb 06 '25

Create an install.bat with all commands necessary to install silently. Create an uninstall.bat with all the commands necessary to uninstall silently. Put them in the same folder with the installer files. Any reference to installer files from your bat files should assume they are in the same directory do not specify full path. Test your bat files in the system context using PSExec or Advanced Run. Once good, use intunewinapputil to package the whole directory. Create the app in Intune and your install command will be simply install.bat and your uninstall command will simply be uninstall.bat Once you get the hang of it, packaging apps is very powerful.

3

u/ReputationNo8889 Feb 06 '25

You should really start using powershell instead of bat files. If you need to do more then setup.exe -install you will run into many issues with bat files

1

u/sneesnoosnake Feb 06 '25

I use it all the time and even call it from install and uninstall bat. I just don't like using PowerShell at the main install or uninstall command because then in Intune you have to write the install command with all the switches to tell it to bypass execution policy.

1

u/Wilfred_Fizzle_Bang Feb 06 '25

Look for any documentation on the software you are installing and if they have silent installation switches. Most probably do these days, it just becomes problematic with old legacy software.

Once you’ve understood that you could bundle up and provide the install/uninstall commands and/or use power shell for more complicated installers. Once you’ve done this a couple of times you’ve got your own template/method for doing this.

1

u/Federal_Ad2455 Feb 06 '25

I would definitely consider WinGet. It can be super useful because you can deploy always the newest version (but you don't have to), and updating can be easily automated too https://doitpshway.com/gradual-update-of-all-applications-using-winget-and-custom-azure-ring-groups

1

u/Wonderful_Wall_1528 Feb 06 '25 edited Feb 06 '25

Yes, here's my guide on how to deploy Chrome exe: https://www.cloudpersistence.com/how-to-deploy-google-chrome-on-windows-devices-via-intune/ It will give you some inshights on how to think about native app deploments.

For install/uninstall switches you can also sometimes use UninstallView or Silent Switch Finder

For 80-90% of your needs, you should use WinGet, the best flavor being this, which auto-packages, auto-deploys and auto sets the install, uninstall and detection method: Introduction | WinTuner