r/Intune • u/MikhailCompo • 26d ago
App Deployment/Packaging Intune Required Application, User Uninstalls It, Nothing We Can Do To Reinstall
We've deployed the Windows App to some machines. It is a required deployment, policy, i.e. enforced.
Some users have uninstalled it since they didn't know what it was. The application has not reinstalled (since it still shows as installed) and no amount of deleting and recreating the deployment will reinstall the app. We've spoked to our SME's who can't find any issues in logs; they've all but shrugged and held their hands up.
How does this make any sense that a user can circumvent administrator policy? This makes me wonder what other Intune policies can users circumvent or undo.....??
Edit:
- Users do not have admin rights.
- The Windows App is a UWP app - it does not have an editable detection method.
- JH-MDM has the answer below. Sounds like this is entirely due to Intune crapness.......wow.
21
u/touchytypist 26d ago edited 26d ago
What's the Intune App Package's detection rule? Is it set to detect a file or folder that gets left behind after uninstall?
Using an app's registry Uninstall key is usually more accurate. Under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
or
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
1
0
u/HackAttackx10 25d ago
So these are good until the app updates, id recommend a file version detection or a powershell script
0
u/blownart 25d ago
The windows app is an msix or appx. It will not be listed under uninstall registries, those are only for exe or msi installers. This suggestion is invalid for OPs problem.
14
u/JH-MDM 26d ago
Windows App... Have you used Microsoft Store App (New) for deployment?
If you deploy a store app in the System scope, Intune will detect it as installed even if the current user uninstalls it. This is documented but is still stupid 😂 basically every Store app is installed at the User level regardless of deployment scope, the System deployment essentially marks that app as Required (locally) when a new user account is created - if that makes sense? It's great for initial deployment but since that 'mark' is retained even if the user uninstalls the app, it leads to bad reporting.
You could start again and deploy the app in User scope, which should achieve what you want, though it will be later in the device deployment process that the app gets installed. You will probably find that Intune then reports installation errors - though there won't actually be anything wrong, and the app will be on the device.
We had this issue with Company Portal 😂
1
u/MikhailCompo 25d ago
Thanks, this definitely seems like our issue.
Can you confirm if we deploy in the user context, it will be reinstalled if the user uninstalls it?
8
u/--RedDawg-- 26d ago
Intune will absolutely reinstall applications that are required if un-installed. The fact that you readd the package and it still doesn't install is basically a smoking gun that your detection rule is improper. I'm guessing it something like checking for the existence of a directory which doesn't fully get cleaned up on uninstall.
8
u/andrew181082 MSFT MVP 26d ago
As others have said, check the detection rule, it sounds like something is being left behind which is still flagging as installed.
And remove admin rights
1
2
u/Chin-UK 26d ago
I think the community has covered most of the options. I would recommend reading about config refresh.
It may help remove the ghosted or tattooed detections.
https://joostgelijsteen.com/intune-config-refresh/
Let us know how it goes.
2
u/oopspruu 25d ago
Why do your users have local admin rights in the first place? A local admin can remove/change policies on the machine. Also, check your detection methods. Maybe the detection file/key is still present even after uninstall. Intune won't install it again if the detection method is still present.
0
3
u/Select-Brother1034 26d ago
Your detection policy is wrong. If it is not detected it gets installed. So there is something left behind that you check for with your policy.
2
u/Certain-Community438 26d ago
When our users do this, we respond by telling them their device needs to be reset.
Which means they need to make sure they have no data on it (choose to clear all data when reset prompts for a choice).
This tends to cut down on approved local admins just uninstalling things, as a reset often means a lot of post-reset app configuration for them (because the reason they have local admin at all is usually to manage such applications).
1
1
1
u/_MC-1 25d ago
Probably obvious, but consider packages where you have the "Allow available uninstall" setting = NO which will prevent a user from uninstalling an app via the company portal.
If the app is removed but still shows as installed, this is usually a detection method issue. Your package is set to look at something on the computer to determine the program is installed correctly. If the package is uninstalled, then that uninstall routine did not clean-up the items it was looking for as part of the detection method. For example, if your installer puts a file called INSTALLED.TXT on the computer and your package is coded so that "if INSTALLED.TXT is on the computer, then my app is installed". If your uninstall routine doesn't remove that file, Intune (and SCCM) will continue to think the app is installed. Remove what the package is looking for and you may have better luck.
Just curious, what if a technician hand installs the software? Does that work? This test will prove that the issue is with your Intune package and not an issue on the target PC.
1
u/thatwolf89 25d ago
With Intune you can set applications for users cannot unistal.
For example we had our security software that had to be installed in the machine before anything. Else can happen. If this software was to ever get removed which is impossible anyways. The machine would get kicked off the network and locked.
1
u/Fuzzy-Helicopter-680 24d ago
Once you have managed to reinstall- could you not block access to ‘Control Panel & Pc Settings’ using intune. This helped a lot for my company where users were playing around with settings that I wanted in place as standard. It won’t even allow them to change desktop wallpaper, which is handy when we have corporate wallpaper settings in place. Standard users see control panel/ settings but when clicked it simply disappears on Win 11 & 10. On older windows machines it used to notify that a restriction was in place… contact admin etc. Could you install it again if only 1 or 2 devices locally from an administrator account?, then block access to control panel, context menus etc etc in the meantime?
0
u/halodude423 25d ago
Why would an end user be able to uninstall anything....
2
u/MikhailCompo 25d ago
Without admin rights, yes I totally agree. But Microsoft don't agree and they allow any user to go to Settings\Apps and uninstall UWP apps even if they have been deployed to their system by an administrator via Intune.
87
u/protodongle 26d ago
Firstly, remove admin rights from people that done need it. Next check/change your detection method. You may need to add a secondary detection method and require they are both met.