You search for a free EXE to MSI converter. You find a few options. You pick one, run it, and get a file. Then you open Intune, and the real work starts — because the file is just a file. No detection rule. No uninstall string. No silent switch. You are back to hunting.
This article documents exactly what each free option produces, where it stops, and what the missing outputs cost you in deployment time.
The Four Outputs a Deployable Package Actually Needs
Before comparing tools, define what "done" looks like. A package ready to deploy in Intune or SCCM requires four things:
- The converted file — MSI or
.intunewin, depending on your deployment target - Silent install arguments —
/S,/quiet,/qn, or framework-specific flags that suppress all UI during deployment - Detection rule — a registry key, file path, or GUID that Intune uses to confirm the app is installed
- Uninstall string — the exact command Intune or SCCM calls to remove the app cleanly
Every free tool on this list produces item one. None of them reliably produce items two through four. That gap is where your deployment time goes.
Option 1: Microsoft Win32 Content Prep Tool
What it is: A free command-line utility from Microsoft that wraps a folder of files into a .intunewin archive — the format Intune requires for Win32 app deployments.
What it produces:
- A
.intunewinfile, ready to upload to Intune - Nothing else
What it does not produce:
- Silent install arguments — you supply those manually
- Detection rule GUIDs — you configure those in the Intune portal
- Uninstall strings — you write those yourself
- An MSI wrapper — it wraps whatever you give it, including a raw EXE, but does not repackage it
The Win32 Content Prep Tool is not a converter. It is a packager. Hand it a raw EXE and you get a .intunewin containing that EXE. Intune still needs to know how to run it silently, how to detect it, and how to remove it. You provide all of that.
Gotcha: Many admins upload an EXE-inside-.intunewin and discover the silent switch they guessed was wrong. The deployment runs, the installer UI surfaces on the endpoint, and the install either fails or completes interactively. In production. On someone's laptop.
Time cost: 20 to 45 minutes per app to research the correct silent flags, test them, build the detection rule, and write the uninstall string by hand.
Option 2: PSAppDeployToolkit (PSADT)
What it is: A free, open-source PowerShell framework that wraps installer deployments in a standardized script. It handles user interaction, logging, deferred installs, and exit codes.
What it produces:
- A structured PowerShell deployment script
- Consistent logging and exit code handling
- A reusable template for complex install sequences
What it does not produce:
- An MSI wrapper
- A
.intunewinfile — you still need the Win32 Content Prep Tool for that step - Automatic silent switch detection
- Detection rule GUIDs or uninstall strings
PSADT is genuinely useful for complex deployments — apps that need pre/post-install steps, user notifications, or restart handling. It is not a converter. It is a scripting framework. You still need to know the silent switches, write the detection logic, and handle the uninstall command yourself.
Gotcha: PSADT requires real PowerShell competence. If you are not comfortable writing and debugging .ps1 files, the template does not help you. For a packaging specialist, it is the right tool. For a generalist IT admin who needs a deployable package in 30 minutes, it is the wrong one.
Time cost: 1 to 3 hours per app if you are fluent in PowerShell. More if you are not.
Option 3: Manual WiX Toolset
What it is: WiX (Windows Installer XML) is an open-source toolset that compiles XML source files into MSI packages. It is what professional packaging engineers use to build clean, signed MSIs from scratch.
What it produces:
- A properly structured MSI with full Windows Installer compliance
- A signed package if you configure code signing
- Complete control over every install property, GUID, and registry entry
What it does not produce:
- Anything automatically — every element requires manual authoring
- Silent switch detection
- Detection rule GUIDs or uninstall strings unless you write them into the WiX source
WiX is not a free EXE to MSI converter. It is a compiler. You write the XML, define the component tree, assign the ProductCode GUID, specify the install directory, and compile. Repackaging an existing EXE with WiX means capturing the EXE's install behavior — usually via snapshot diffing in a clean VM — then authoring that behavior in WiX XML. That is a full packaging project.
Gotcha: ProductCodes change between versions. If you hard-code a ProductCode in your WiX source and the vendor ships a new version, your MSI upgrade logic breaks. Do not use static ProductCodes for apps with frequent updates unless you have a versioning process built around them.
Time cost: 3 to 8 hours per app for someone who knows WiX. Days for someone learning it. This is not a self-service option.
For a deeper look at when to extract an MSI directly from an EXE versus repackaging it, see how to extract an MSI from an EXE — sometimes the MSI is already embedded and you do not need to repackage at all.
What the Free Options Have in Common
- Win32 Content Prep Tool — produces
.intunewinonly. No MSI, no silent switch detection, no detection GUID, no uninstall string. - PSADT — produces a PowerShell wrapper script. No MSI, no
.intunewin, no silent switch detection, no detection GUID, no uninstall string. - WiX (manual) — produces an MSI. No
.intunewin, no silent switch detection, no auto-generated detection GUID or uninstall string unless you author them.
Every free option stops at the file. The deployment metadata — the part Intune actually needs to function — is always on you.
That is not a criticism of these tools. The Win32 Content Prep Tool does exactly what Microsoft designed it to do. PSADT solves a real problem for complex deployments. WiX is the right answer for full MSI authoring projects. None of them were designed to close the last mile between a raw EXE and a paste-ready Intune deployment.
What the Missing Outputs Actually Cost
Silent switch research: For common frameworks like Inno Setup (/VERYSILENT /SUPPRESSMSGBOXES), NSIS (/S), or InstallShield (/s /v"/qn"), the flags are documented. For custom or poorly documented installers, you are reading PE headers, running strings against the binary, or trial-and-erroring in a clean VM. Budget 20 to 60 minutes per unknown installer.
Detection rule authoring: Intune requires a detection rule to confirm installation. The safe pattern is a registry key check under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{GUID} or a file version check. Finding the right key, confirming it survives upgrades, and entering it correctly in the Intune portal takes 10 to 20 minutes per app when you know what you are doing. When you do not, it fails silently in production.
Uninstall string: MSI-based apps expose a clean uninstall string via MsiExec.exe /X {ProductCode}. EXE-based apps vary — some use unins000.exe, some use a vendor-specific utility, some have no documented uninstall path. Getting this wrong means Intune reports the app as removed when it is not.
Across 10 apps per month, those gaps add up to 5 to 15 hours of manual work that free tools do not eliminate.
Where InstallMage's Free Tier Fits
InstallMage's Starter tier is free, requires no credit card, and gives you 3 conversions per month. The pipeline is: Upload → AI Scan → Convert and Test → Download. The AI engine fingerprints the installer framework from the binary — Inno Setup, NSIS, InstallShield — extracts the correct silent arguments automatically, and compiles a WiX-based MSI wrapper in an isolated Linux container.
The output is not just a file. It includes ready-to-paste install commands, the uninstall string, and detection rule GUIDs for Intune. The EXE runs in an ephemeral container and is permanently deleted after conversion. Nothing is stored.
That covers all four outputs listed at the top of this article. In under 3 minutes.
The 250 MB file size limit on the free tier is a real constraint. If your EXE is larger, Starter will not process it. For unlimited conversions, files up to 1 GB, native .intunewin generation, and BYOC code signing via .pfx upload, Pro is $39 per month. For context, that is roughly what Advanced Installer Enterprise costs per user per month at its $1,399 per year rate — and Advanced Installer requires packaging expertise and a VM snapshot workflow to do what InstallMage does automatically.
For a full breakdown of the conversion process and when MSI is the right output format versus .intunewin, the EXE to MSI conversion guide covers the decision logic in detail. If you are unsure which package format your deployment actually needs, MSIX vs MSI vs EXE explained is worth reading before you start.
The Honest Trade-Off
Free tools are not bad. They are incomplete for Intune deployments. The Win32 Content Prep Tool is the right choice if you already have the silent switches, detection rule, and uninstall string in hand. PSADT is the right choice if you have complex pre/post-install requirements and real PowerShell skills. WiX is the right choice if you are building a production MSI from scratch with full control.
None of them are the right choice if you need a deployable package in 30 minutes and do not want to spend the afternoon hunting switch documentation.
The free tier at installmage.com handles 3 conversions per month at no cost. If that covers your volume, it is the most complete free option on this list. If it does not, Pro at $39 per month is still cheaper than the first month of any enterprise packaging tool.
FAQs
Does the Microsoft Win32 Content Prep Tool convert EXE to MSI?
No. It wraps files into a .intunewin archive for Intune deployment. Hand it an EXE and you get a .intunewin containing that EXE. It does not repackage the installer, detect silent switches, or generate detection rules.
Can PSADT replace a proper EXE to MSI converter?
No. PSADT is a PowerShell scripting framework for standardizing deployments. It does not produce MSI files or .intunewin packages on its own. You still need a separate tool for file conversion and still need to supply all silent arguments and detection logic manually.
What silent switch does an Inno Setup installer use?
The standard flags are /VERYSILENT /SUPPRESSMSGBOXES /NORESTART. Some Inno Setup installers also accept /DIR= for install path overrides. Confirm by running setup.exe /? or checking the binary with a strings utility if the vendor does not document it.
What is the fastest free option for generating a complete Intune-ready package?
InstallMage's Starter tier is free, requires no credit card, and produces a converted MSI or .intunewin plus silent install commands, detection rule GUIDs, and uninstall strings in under 3 minutes. The 250 MB file size limit applies. For files under that threshold, it is the only free option that closes all four deployment requirements without manual work.
Why does detection rule authoring matter so much for Intune deployments?
Intune uses the detection rule to determine whether an app is installed on an endpoint. If the rule is wrong or missing, Intune either repeatedly re-deploys the app or reports it as installed when it is not. Both failure modes are silent and only surface during audits or when users report problems.
Is a WiX-compiled MSI better than a wrapped EXE for Intune?
For compliance-heavy environments, yes. A WiX-based MSI exposes a proper ProductCode, supports Windows Installer repair-on-demand, and integrates cleanly with SCCM and Intune's MSI deployment path. The trade-off is authoring time. InstallMage compiles its MSI wrappers with WiX automatically — you get the structural benefits without the manual authoring overhead.
What happens to my EXE after conversion on InstallMage?
Each EXE runs in an isolated, stateless Linux container and is permanently deleted immediately after conversion completes. Nothing is stored or archived. There is no retention window.