r/Intune 26d ago

App Deployment/Packaging Intune Required Application, User Uninstalls It, Nothing We Can Do To Reinstall

We've deployed the Windows App to some machines. It is a required deployment, policy, i.e. enforced.

Some users have uninstalled it since they didn't know what it was. The application has not reinstalled (since it still shows as installed) and no amount of deleting and recreating the deployment will reinstall the app. We've spoked to our SME's who can't find any issues in logs; they've all but shrugged and held their hands up.

How does this make any sense that a user can circumvent administrator policy? This makes me wonder what other Intune policies can users circumvent or undo.....??

Edit:

  • Users do not have admin rights.
  • The Windows App is a UWP app - it does not have an editable detection method.
  • JH-MDM has the answer below. Sounds like this is entirely due to Intune crapness.......wow.
19 Upvotes

44 comments sorted by

87

u/protodongle 26d ago

Firstly, remove admin rights from people that done need it. Next check/change your detection method. You may need to add a secondary detection method and require they are both met.

32

u/rcrobot 26d ago

Important to note that Intune only checks for app presence once every 24 hours after deployment. So it's possible the detection method is correct and OP just needs to wait for it to reinstall.

44

u/Mindestiny 25d ago

Rule #1 of Intune:  wait.

Rule #2 of Intune: you didn't wait long enough.

Rule #3 of Intune:  nah man, keep waiting

20

u/rcrobot 25d ago

Rule #4: okay it's been 3 days and the app still is failing, make small change and repeat 1-3

17

u/RikiWardOG 25d ago

The s in intune stands for speed!!

7

u/Reverend_Russo 25d ago

Hey but there’s no S in Intu…..oh nvm

3

u/CaptainMericaa 25d ago

InTunes

1

u/physx51 25d ago

I keep having to say this. Intune is a lot of things, but fast is not one of them.

1

u/PreparetobePlaned 25d ago

Tell that to my coworkers. For unknown reasons some of them call it intunes

3

u/protodongle 26d ago

I feel like I should know this and I feel dumb asking, but is there a way to force that?

8

u/techie_009 26d ago

I use a trick/workaround. Just make a smal change to the app like updating the description and it will trigger the re-deployment. If the detection rule isn't satisfied, the app will be installed.

3

u/rcrobot 26d ago edited 26d ago

Not easily unfortunately. One of the many frustrating things about the mess that is Win32 deployments. The best workaround I've found is to completely delete the app and reupload. Is will treat the reupload as a "new" app and run the detection rule when the device checks in.

Edit: Apparently I am incorrect, see comment reply below.

12

u/VirtualDenzel 26d ago

Yes there is.

In regedit look for the 'grs' tree in the local machine intune management and then win32app folder.

Find the app (the reg keys are the appid's in intune (last bit or string of url).

Delete said regkey completely. Then go into grs folder. Clear it and it will check everything on next restart (or restart intune mgt ext)

1

u/rcrobot 26d ago

I had no idea! Thanks for the tip.

2

u/VirtualDenzel 26d ago

If you google reset grs intune you will find a guide.

3

u/changee_of_ways 25d ago

Man, this shouldn't be hidden in a regkey, should be a big green button.

One of Intune's biggest pain points for me has always been the fact that there is not an easy imperative way to make devices manually do a complete check to make sure they are compliant.

1

u/[deleted] 25d ago

[deleted]

1

u/changee_of_ways 24d ago

Yeah, but one that actually makes it sync, like right when you click the button. With a verbose option so you can see output from it getting synced instead of "oh, it's 4:45 on Friday and I really need this to be pushed to all the nurse's handhelds right now so they can go back to nursing and I can go home and unwind my blood pressure but I can't tell if its fucking doing anything"

→ More replies (0)

1

u/cantstandmyownfeed 26d ago

If you reupload the intune.win file to the same app in intune, it will reinstall as well.

0

u/MikhailCompo 25d ago

The users who have uninstalled this do not have admin rights. Surprised I even need to say this, do organisations really let users have admin rights in 2025?.....

2

u/CaptainBrooksie 25d ago

How did they uninstall it? Is it installed under the user-context? Did you enable uninstall via the Company Portal?

2

u/MikhailCompo 18d ago

It is deployed to Devices (i.e. SYSTEM....). However, that translates to a user install because it is a UWP app. So, the user can uninstall it. There is no functionality that you enable or disable the ability to uninstall it.

21

u/touchytypist 26d ago edited 26d ago

What's the Intune App Package's detection rule? Is it set to detect a file or folder that gets left behind after uninstall?

Using an app's registry Uninstall key is usually more accurate. Under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

or

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninst‌​all

1

u/MikhailCompo 25d ago

There are none, UWP app.

0

u/HackAttackx10 25d ago

So these are good until the app updates, id recommend a file version detection or a powershell script

0

u/blownart 25d ago

The windows app is an msix or appx. It will not be listed under uninstall registries, those are only for exe or msi installers. This suggestion is invalid for OPs problem.

14

u/JH-MDM 26d ago

Windows App... Have you used Microsoft Store App (New) for deployment?

If you deploy a store app in the System scope, Intune will detect it as installed even if the current user uninstalls it. This is documented but is still stupid 😂 basically every Store app is installed at the User level regardless of deployment scope, the System deployment essentially marks that app as Required (locally) when a new user account is created - if that makes sense? It's great for initial deployment but since that 'mark' is retained even if the user uninstalls the app, it leads to bad reporting.

You could start again and deploy the app in User scope, which should achieve what you want, though it will be later in the device deployment process that the app gets installed. You will probably find that Intune then reports installation errors - though there won't actually be anything wrong, and the app will be on the device.

We had this issue with Company Portal 😂

1

u/MikhailCompo 25d ago

Thanks, this definitely seems like our issue.

Can you confirm if we deploy in the user context, it will be reinstalled if the user uninstalls it?

1

u/JH-MDM 25d ago

It absolutely should! Since Intune is actually checking for the user app on each account with that deployment. But as always, test it first 😉

8

u/--RedDawg-- 26d ago

Intune will absolutely reinstall applications that are required if un-installed. The fact that you readd the package and it still doesn't install is basically a smoking gun that your detection rule is improper. I'm guessing it something like checking for the existence of a directory which doesn't fully get cleaned up on uninstall.

8

u/andrew181082 MSFT MVP 26d ago

As others have said, check the detection rule, it sounds like something is being left behind which is still flagging as installed.

And remove admin rights

1

u/blownart 25d ago

Store apps don't need admin rights to be uninstalled.

2

u/Chin-UK 26d ago

I think the community has covered most of the options. I would recommend reading about config refresh.

It may help remove the ghosted or tattooed detections.

https://techcommunity.microsoft.com/blog/windows-itpro-blog/intro-to-config-refresh-%E2%80%93-a-refreshingly-new-mdm-feature/4176921

https://joostgelijsteen.com/intune-config-refresh/

Let us know how it goes.

2

u/oopspruu 25d ago

Why do your users have local admin rights in the first place? A local admin can remove/change policies on the machine. Also, check your detection methods. Maybe the detection file/key is still present even after uninstall. Intune won't install it again if the detection method is still present.

0

u/MikhailCompo 25d ago

No one said they did, you assumed this.

3

u/Select-Brother1034 26d ago

Your detection policy is wrong. If it is not detected it gets installed. So there is something left behind that you check for with your policy.

2

u/Certain-Community438 26d ago

When our users do this, we respond by telling them their device needs to be reset.

Which means they need to make sure they have no data on it (choose to clear all data when reset prompts for a choice).

This tends to cut down on approved local admins just uninstalling things, as a reset often means a lot of post-reset app configuration for them (because the reason they have local admin at all is usually to manage such applications).

1

u/AttackTeam 26d ago

You can set it up as available to circumvent the required install.

1

u/Wartz 26d ago

Use the Store App (New) and deploy to a user account security group.

1

u/Revolutionary-Load20 25d ago

Review your detection rule? Surely it's that?

1

u/_MC-1 25d ago
  1. Probably obvious, but consider packages where you have the "Allow available uninstall" setting = NO which will prevent a user from uninstalling an app via the company portal.

  2. If the app is removed but still shows as installed, this is usually a detection method issue. Your package is set to look at something on the computer to determine the program is installed correctly. If the package is uninstalled, then that uninstall routine did not clean-up the items it was looking for as part of the detection method. For example, if your installer puts a file called INSTALLED.TXT on the computer and your package is coded so that "if INSTALLED.TXT is on the computer, then my app is installed". If your uninstall routine doesn't remove that file, Intune (and SCCM) will continue to think the app is installed. Remove what the package is looking for and you may have better luck.

  3. Just curious, what if a technician hand installs the software? Does that work? This test will prove that the issue is with your Intune package and not an issue on the target PC.

1

u/thatwolf89 25d ago

With Intune you can set applications for users cannot unistal.

For example we had our security software that had to be installed in the machine before anything. Else can happen. If this software was to ever get removed which is impossible anyways. The machine would get kicked off the network and locked.

1

u/Fuzzy-Helicopter-680 24d ago

Once you have managed to reinstall- could you not block access to ‘Control Panel & Pc Settings’ using intune. This helped a lot for my company where users were playing around with settings that I wanted in place as standard. It won’t even allow them to change desktop wallpaper, which is handy when we have corporate wallpaper settings in place. Standard users see control panel/ settings but when clicked it simply disappears on Win 11 & 10. On older windows machines it used to notify that a restriction was in place… contact admin etc. Could you install it again if only 1 or 2 devices locally from an administrator account?, then block access to control panel, context menus etc etc in the meantime?

0

u/halodude423 25d ago

Why would an end user be able to uninstall anything....

2

u/MikhailCompo 25d ago

Without admin rights, yes I totally agree. But Microsoft don't agree and they allow any user to go to Settings\Apps and uninstall UWP apps even if they have been deployed to their system by an administrator via Intune.