Intune Win32 App Deployment: Complete Guide from Packaging to Monitoring

Win32 app deployment is the most capable and most commonly used application deployment method in Microsoft Intune. It handles EXE, MSI, MSP, BAT, CMD, and PowerShell-based installers — anything that does not fit the Store app model. Mastering it means understanding the packaging tool, detection rules, the installation pipeline, and the IME logs that tell you exactly what went wrong. This guide covers the full lifecycle: from wrapping an app with IntuneWinAppUtil all the way to monitoring installation success across your device fleet.

1. What is a Win32 App?

A Win32 app is any traditional Windows application packaged for Intune deployment using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil). The tool wraps the application files into a single .intunewin file — an encrypted package that Intune can distribute and the IME can unpack and install on managed devices.

2. Win32 App Deployment Flow

3. Packaging with IntuneWinAppUtil

The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) wraps your app into the .intunewin format. It must be run from a command line and takes three parameters: the source folder, the setup file, and the output folder.

IntuneWinAppUtil.exe -c "C:\AppSource\MyCorporateApp" -s "setup.exe" -o "C:\IntuneOutput"

REM   -c  source folder containing all app files
REM   -s  the setup file (entry point — EXE or MSI)
REM   -o  output folder for the .intunewin file

4. Creating the Win32 App in Intune

Install and Uninstall Commands

Install Behavior

System context runs as SYSTEM — required for most enterprise apps (writes to Program Files, modifies HKLM registry). User context runs as the logged-on user — for per-user apps that write to HKCU or AppData. Always use System unless the app explicitly requires user context.

5. Detection Rules

Detection rules tell Intune whether the app is already installed. If the detection rule evaluates to true, Intune considers the app installed and will not reinstall it. This is the most important setting to get right — a bad detection rule causes constant reinstallation or silent failure.

# Detection script — exits 0 if installed, non-zero if not
$regPath = "HKLM:\SOFTWARE\MyCorp\App"
$regValue = "Version"
$expected = "2.1.0"

if (Test-Path $regPath) {
  $actual = (Get-ItemProperty $regPath).$regValue
  if ($actual -eq $expected) {
    Write-Host "Detected"
    exit 0  # 0 = detected
  }
}
exit 1  # non-zero = not detected, Intune will install

6. App Assignment Types

7. The Installation Process on the Device

8. Monitoring and Reporting

# On the target device — watch the IME log while the install runs
$log = Get-ChildItem "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" |
  Where {$_.Name -like "IntuneManagementExtension*.log"} | Sort LastWriteTime -Desc | Select -First 1

Get-Content -Path $log.FullName -Tail 40 -Wait   # -Wait streams new lines live

9. Common Error Codes

10. Best Practices

• Always configure both install and uninstall commands — Intune needs the uninstall command for app removal
• Use a registry key detection rule for EXE-based apps where possible — file version detection is fragile
• Test on pilot devices first using an Available assignment before switching to Required
• Use a meaningful app name and version number — "Setup.exe" as the app name makes the Intune portal unmanageable at scale
• Set Return codes correctly — 0=success, 1707=success, 3010=soft reboot required, 1641=hard reboot required
• For apps with dependencies, use the Dependencies tab — Intune will install dependencies automatically in the correct order
• Keep apps updated by adding a new version — do not overwrite the existing Win32 app entry; create a new one and use supersedence

Official References

• Win32 app management in Microsoft Intune
• Prepare a Win32 app for upload to Intune
• Add a Win32 app to Microsoft Intune
• Troubleshoot Win32 app installations in Intune
• Win32 apps in S mode