Recently, I have been doing a lot of Microsoft Intune deployments and write up’s. One of the most time-consuming tasks with Intune is the application portion, where you package applications up to deploy to your end-user machines. Currently, if the application is bundled as an executable (exe), the steps to get it into Intune is as follows:

• Grab the installation executable
• Find the install switches – most common one is the silent switch, but some applications may have other switches you will need as well
• Find the install directory or registry key to tell Intune if it installed correctly or not
• Find the uninstall executable and any switches it has as well
• Wrap the executable in an ‘INTUNEWIN’ format
• Import file into Intune
• Configure the application with the install and uninstall switches as well as the directory it creates to Intune knows if it installed correctly or not

This process may need to be replicated when the application is upgraded, and you want to push out the updated app to your Intune devices.

However, if we used Chocolatey, a package manager and installer for software packages, we could considerably speed up the Intune application package deployment process because we would no longer need to:

• Find any install switches
• Grab the installation executable
• Find the uninstall process and switches
• Configure the application with any install switches, or uninstall switches within the Intune blade

If you decided to use Intune configuration PowerShell scripts, you also would not need to wrap anything in the INTUNEWIN format or specify install directories. However, I like to have my applications all under the Intune Applications blade instead of the configuration blade for ease of management and administration purposes. This method will also allow me to specify chocolatey as a dependancy for my applications, so if chocolatey present and I am installing VSCode using chocolatey, it will automatically install it prior to the VSCode installation.

INTUNEWIN Deployment Packages Overview

First, let’s take a look at the INTUNEWIN file format so we can understand how we will get all of this to work properly. To deploy applications that get installed via an executable you would need to wrap it in an INTUNEWIN wrapper and import that into Intune. Think of an INTUNEWIN file as an encrypted zip file that contains all of your installation files for your application. To wrap your install directory in an INTUNEWIN format, you will need to use the Microsoft Win32 Content Prep Tool. “The packaging tool converts application installation files into the .intunewin format. The packaging tool also detects the parameters required by Intune to determine the application installation state. After you use this tool on your apps, you will be able to upload and assign the apps in the Microsoft Intune console.”¹

1 – Deploy Chocolatey with Intune

Chocolatey will be the package manager that will end up installing all of our applications via Intune. As mentioned earlier, this is much better than manually getting all the installs yourself and preparing it for Intune as you no longer need to research any command-line switches to install or uninstall, nor do you need to re-package the application when it gets updated.

First, we need to create our Chocolatey deployment for Intune. In the same directory as your IntuneWinAppUtil.exe from the Microsoft Win32 Content Prep Tool, create a new directory called Chocolatey

Save the PowerShell script below in your Chocolatey directory and name it install.ps1. 

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

In PowerShell or CMD, navigate to the directory with the IntuneWinAppUtil.exe and start the executable.

Next, we will need to specify the source folder that has our install files, the setup file (which is our install.ps1 file), and the output folder where it will spit out the INTUNEWIN file.

Here we see that it successfully created our INTUNEWIN file to import into Intune.

Next, in Intune blade go to Client Apps > Apps > + Add

Select Windows App (Win32)

Import your install.intunewin file you created earlier. In the App Information pane, you can modify the application info, including name, description, publisher, and even give it a proper logo to display in the Company Portal.

For the install command put: powershell.exe -executionpolicy bypass .\install.ps1

You can put anything for the uninstall command as we did not configure an uninstall script. If you did create one, you could dot-source it like the install.ps1 file.

Note: If you notice, we don’t need to specify silent install switches with chocolatey or its packages. This is because its all done silently by default

For our detection rules, we will tell Intune that Chocolatey is installed if the Chocolatey folder is present under C:\ProgramData\

In the end, we can review our new Intune application. In my example, I just deployed it to all users and all devices

2 – Install Applications Using Intune + Chocolatey – Examples

In the next section, I will show you how to use Chocolatey + Intune to install and uninstall applications. The method is the same for each application, so if your application is not listed, you can follow the same instructions for your app. You will need to locate the package on the Chocolatey repository.

NOTE: All applications that are shown below, as well as more, are all available at this central repository, which includes the install/uninstall scripts and the applications intunewin file.

Google Chrome

Looking in the Chocolatey repository, I can see the install command for Google Chrome is: choco install googlechrome

So my install script (install.ps1) for Google Chrome will look like the following:

$localprograms = choco list --localonly
if ($localprograms -like "*googlechrome*")
{
    choco upgrade googlechrome
}
Else
{
    choco install googlechrome -y
}

I put the IF statement in there in case it’s already installed I’m just telling Intune to update the application

And my uninstall.ps1 file will look like the following:

choco uninstall googlechrome -y

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)

Which will spit you out this file that you can download here

Finally, you would configure your new Win32 application in Intune the same way we did Chocolatey, but the detection rules would be

My app configuration would look like the following

Mozilla Firefox

Looking in the Chocolatey repository, I can see the install command for Firefox is: choco install firefox

So my install script (install.ps1) for Firefox will look like the following:

$localprograms = choco list --localonly
if ($localprograms -like "*firefox*")
{
    choco upgrade firefox -y
}
Else
{
    choco install firefox -y
}

I put the IF statement in there in case it’s already installed I’m just telling Intune to update the application

And my uninstall.ps1 file will look like the following:

choco uninstall firefox -y

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)

Which will spit you out this file that you can download here

Finally, you would configure your new Win32 application in Intune the same way we did Chocolatey, but the detection rules would be

My app configuration would look like the following

Microsoft Edge

Looking in the Chocolatey repository, I can see the install command for Microsoft Edge is: choco install microsoft-edge

So my install script (install.ps1) for Firefox will look like the following:

$localprograms = choco list --localonly
if ($localprograms -like "*microsoft-edge*")
{
    choco upgrade microsoft-edge -y
}
Else
{
    choco install microsoft-edge -y
}

I put the IF statement in there in case it’s already installed I’m just telling Intune to update the application

And my uninstall.ps1 file will look like the following:

choco uninstall microsoft-edge -y

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)

Which will spit you out this file that you can download here

Finally, you would configure your new Win32 application in Intune the same way we did Chocolatey, but the detection rules would be

My app configuration would look like the following

Adobe Acrobat Reader

Looking in the Chocolatey repository, I can see the install command for Adobe Reader is: choco install adobereader

So my install script (install.ps1) for Firefox will look like the following:

$localprograms = choco list --localonly
if ($localprograms -like "*adobereader*")
{
    choco upgrade adobereader -y
}
Else
{
    choco install adobereader -y
}

I put the IF statement in there in case it’s already installed I’m just telling Intune to update the application

And my uninstall.ps1 file will look like the following:

choco uninstall adobereader -y

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)

Which will spit you out this file that you can download here

Finally, you would configure your new Win32 application in Intune the same way we did Chocolatey, but the detection rules would be

My app configuration would look like the following

3 – Create an Application Dependancy

One of the benefits of deploying the application as a Win32 is that we can specify application dependencies. Since I am deploying my applications using Chocolatey, I want to set the Chocolatey app as a dependency, so if it’s not found on the machine, it will auto-install it for me.

In the Intune Portal, I can edit the application and select Dependencies and specify the Chocolatey app and force it to auto-install if it is not present. You can also specify dependencies when you are creating the application in Intune.

Sources

1. https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool