Deploy Win32 apps in Intune: package, detect and assign

Deploy Apps with Intune Win32

Win32 apps are the main way to deploy traditional desktop software with Microsoft Intune. Unlike MSI or Store apps, the Win32 app type lets you set the install and uninstall commands, requirements, detection rules, dependencies and return codes. This page walks through the packaging and setup steps in the order the Microsoft Intune admin center presents them.

Why Win32?

• Large apps: Microsoft Learn lists a limit of 30 GB per app.
• Custom installs: you supply the install command, or a PowerShell script as the installer.
• Requirements: check device attributes before the app is offered.
• Detection: rules based on MSI product code, files, registry values or a script.

The installer must run silently. Microsoft Learn states that Intune does not support interactive installations, so an installer that shows dialogs or waits for input is not supported. If an app installs fine by hand but fails when deployed, see Intune Win32 app installs manually but fails when deployed.

The Packaging Tool

Intune uploads Win32 apps as .intunewin files, which you create with the Microsoft Win32 Content Prep Tool. Microsoft Learn says to download it from GitHub: https://github.com/microsoft/Microsoft-Win32-Content-Prep-Tool. You run it as IntuneWinAppUtil.exe.

Keep the tool outside the folder that holds your installer files. Learn notes that the tool compresses every file and subfolder in the setup folder into the .intunewin file, so anything extra in that folder ends up in the package.

The tool takes these parameters:

Parameter	Meaning
-c <setup_folder>	Folder with all setup files. Everything in it is compressed.
-s <setup_file>	Setup file, such as setup.exe or setup.msi.
-o <output_folder>	Output folder for the .intunewin file.
-q	Quiet mode.

# Placeholder paths and file name. Replace them with your own.
.\IntuneWinAppUtil.exe -c C:\Apps\ExampleApp\Source -s ExampleSetup.exe -o C:\Apps\ExampleApp\Output

If you run the tool with no parameters, it prompts for them step by step. For an MSI setup file, the tool reads the information Intune needs from the MSI.

Step-by-Step Deployment

Step 1: Prepare the App

1. Put the installer files in one setup folder, and keep the Content Prep Tool outside it.
2. Run IntuneWinAppUtil.exe with the -c, -s and -o parameters shown above.
3. Use the .intunewin file from the output folder in the next step.

Learn also says to use the latest version of the Content Prep Tool. With an older version, the admin center shows a warning that the app was packaged with an older version of the tool.

Step 2: Upload to Intune

1. In the Microsoft Intune admin center, go to Apps > All apps > Create.
2. Select the Windows platform, then Windows app (Win32), then Select.
3. On App information, select the app package file and browse to your .intunewin file. Fill in the app details.

Step 3: Configure Install and Uninstall

On the Program page, enter the install command and the uninstall command. Use the silent switch your application vendor documents.

# Install command. Learn's example uses the form: ApplicationName.exe /quiet
# The switch depends on the installer, so confirm it with the vendor.
ExampleSetup.exe /quiet

# Uninstall command for an MSI-based app, using the product GUID (placeholder shown).
msiexec /x "{12345A67-89B0-1234-5678-000001000000}"

Details from Microsoft Learn that are easy to miss:

• Installation time required defaults to 60 minutes and has a maximum of 1440 minutes. If the install takes longer than the value, the install fails. See Intune Win32 app timeout 0x87D300C9.
• Calling powershell.exe in the install or uninstall command starts a 32-bit PowerShell instance. To force 64-bit PowerShell, Learn gives %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe.
• Environment variable expansion in the uninstall command is not supported. Wrap the command in a script inside the package if you need it.
• Install behavior is System or User. See Intune Win32 app install behavior: System vs User context.
• Return codes: you can mark codes as Success, Failed, Retry, Soft reboot or Hard reboot. For 3010, see Intune Win32 app returns 3010.

Step 4: Set Requirements

On the Requirements page you choose the operating system architecture and the minimum operating system. You can optionally add more checks:

Requirement	Use When
Disk space required (MB)	The app needs free space on the system drive
Physical memory required (MB)	The app needs a minimum amount of RAM
Minimum number of logical processors	The app needs a minimum processor count
Minimum CPU speed (MHz)	The app needs a minimum CPU speed
File rule	A file or folder, date, version or size must be present
Registry rule	A registry value, string, integer or version must match
Script rule	The check cannot be expressed as a file or registry rule

Devices must meet these requirements before the app is installed. See Intune Win32 app not applicable: fix requirements and applicability mismatches.

Step 5: Detection Rules

Detection rules tell Intune whether the app is already installed. You must add at least one rule, and the conditions of all rules must be met for the app to count as detected. The rule types in Learn are:

Rule type	What it checks
MSI	The MSI product code, and optionally the product version
File	A file or folder, with existence, date, version or size checks
Registry	A registry key or value, with existence, string, integer or version checks
Custom script	A PowerShell script you upload

For a file rule, Path is the folder and File or folder is the name of the file or folder inside it:

Path: C:\Program Files\ExampleApp
File or folder: ExampleApp.exe
Detection method: File or folder exists

For a custom detection script, Learn says the app is detected when the script exits with code 0 and writes something to STDOUT. If the script writes anything to STDERR, the app is evaluated as not installed, even when STDOUT has data and the exit code is 0. Intune does not look for a particular string in STDOUT.

The 32-bit option on file and registry rules matters on 64-bit clients. Learn describes it as “Associated with a 32-bit app on 64-bit clients”, and the default is No. See HKLM vs. HKCU detection rules in Intune Win32 apps and Intune Win32 detection script uses the wrong registry view.

Step 6: Assign to Users or Devices

After dependencies, supersedence and scope tags, the Assignments page offers three assignment types:

• Required: the app is installed on devices in the selected groups.
• Available for enrolled devices: users install the app from the Company Portal app or website.
• Uninstall: the app is uninstalled from devices in the selected groups.

Learn notes that the Intune management extension checks for new Win32 app assignments every hour, and on service or device restart. An app installed through Available for enrolled devices is not automatically reinstalled by Intune if it is later uninstalled.

Troubleshooting

App Not Installing

The Intune management extension (IME) installs the Win32 app on the device. Learn says its logs are typically in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, and that AppWorkload.log in that folder holds the Win32 app deployment activity. Learn recommends CMTrace.exe for viewing the logs.

# Last 100 lines of the Win32 app log, using the folder documented on Microsoft Learn.
$LogPath = "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log"
Get-Content -Path $LogPath -Tail 100

IntuneManagementExtension.log in the same folder is the main IME log, and AppActionProcessor.log tracks detection and applicability checks. For how to read these files, see AppWorkload.log and IME logs: read Intune Win32 failures.

If the portal shows Failed but the app is on the device, see Intune Win32 app installed but shows Failed.

You can also paste an error code or log excerpt into the free Intune App Failure Analyzer. Its page says it runs locally and that your logs stay in the browser. Treat the result as a starting point and confirm it against the logs.

Detection Rule Not Working

# Test a file detection rule path manually (placeholder path)
Test-Path "C:\Program Files\ExampleApp\ExampleApp.exe"

# Check an uninstall registry key (placeholder key name)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\ExampleApp"

These checks only confirm what is on the device from your own PowerShell session. They do not reproduce how the IME evaluates the rule: on 64-bit clients, the rule’s 32-bit option controls whether Intune reads the 32-bit or the 64-bit registry view, and whether path variables expand in the 32-bit or 64-bit context. If the detection works on the device but the portal still shows Failed, see Intune Win32 app detection passes but the portal still says Failed.

Practical Tips

1. Assign to a small test group first and check the app status in the admin center before a wide rollout.
2. Set requirements so the app is only installed on devices that can run it.
3. Write down the install command, uninstall command and detection rule for each app.
4. Confirm the silent install switch with the application vendor, not by guessing.

Sources

Pages read on Microsoft Learn while revising this article:

• Win32 app management in Microsoft Intune: 30 GB per app limit, silent install requirement, IME assignment check.
• Prepare Win32 app content for upload: Content Prep Tool parameters and behavior.
• Add, assign, and monitor a Win32 app in Microsoft Intune: Program, Requirements, Detection rules and Assignments settings.
• Intune Management Extension for Windows: IME log folder and log file descriptions.