Skip to main content
    All posts
    Intune
    Win32 App
    Best Practices
    Deployment

    Intune Win32 App Deployment: Best Practices 2026

    InstallMage TeamApril 15, 202610 min read

    Intune Win32 app deployments either work brilliantly or fail in completely opaque ways. The difference is rarely the app itself — it is detection rules, install context, and requirement scoping. Here is the playbook we follow for every deployment in 2026.

    1. Always use file or registry detection — never MSI ProductCode for Win32 apps

    Intune lets you choose ProductCode detection for MSI-wrapped Win32 apps. Do not. ProductCodes change between versions and your detection silently breaks on the next vendor update. Use a file version check on the main executable instead:

    Path:     C:\Program Files\Acme\App
File:     app.exe
Operator: Greater than or equal to
Version:  1.4.0.0

    File version detection survives upgrades, supersedence, and most reinstalls.

    2. Set requirement rules tight enough to fail fast

    Intune defaults to broad requirements. Tighten them so endpoints that cannot run the app skip the deployment instead of failing it:

    • OS architecture: 64-bit (unless you genuinely ship 32-bit)
    • Minimum OS version: pin to the lowest you actually support
    • Disk space: app size + 500MB buffer

    3. Get the install context right the first time

    System vs. User context is irreversible without recreating the app. Default to system context unless:

    • The installer writes to HKCU or %AppData% only (Squirrel/Electron apps)
    • The app needs the user's identity to license
    • You are deploying browser extensions or per-user shortcuts

    For Squirrel installers (Slack, GitHub Desktop, Discord), user context is the only path that works without repackaging.

    4. Always set a working directory

    Empty working directory is the #1 cause of "file not found" in install scripts. Set it explicitly even when you think you do not need to.

    5. Treat exit codes as a contract

    Intune ships with sensible defaults — 0 success,1707 success, 3010 soft reboot, 1641 hard reboot. If your installer returns custom codes (and many vendor EXEs do), map them in the Return codes section. A misclassified exit code shows up as failure even when the app installed perfectly.

    6. Write deterministic install commands

    The pattern that survives audits and onboarding:

    # Install
"%~dp0Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOG="%TEMP%\acme_install.log"

# Uninstall
"C:\Program Files\Acme\unins000.exe" /VERYSILENT /NORESTART

    Three rules:

    • Always quote paths with spaces.
    • Always log to %TEMP% with an app-specific filename.
    • Never auto-reboot in the install command — let Intune handle it via exit codes.

    7. Use supersedence, not assignment switching

    When you push a new version, do not just point existing assignments at the new app. Use Intune's supersedence relationship. It tracks the upgrade chain, runs the old uninstall before the new install (if you tick that box), and reports cleanly in monitoring.

    8. Always assign to a pilot group first

    Required-assign to a 5–10 device pilot group, wait 24 hours, check the installation status. Only then expand. Intune will happily ship a broken Win32 app to 10,000 endpoints in under an hour.

    9. Mind the .intunewin size limit

    Intune supports up to 30GB per Win32 app, but the practical sweet spot is under 2GB. Larger packages increase failure rates dramatically on flaky networks. If you are over 2GB, host the payload on a CDN and download it from a wrapper script.

    10. Build detection scripts defensively

    If file/registry detection cannot express what you need, fall back to PowerShell. Three rules for detection scripts:

    • Exit code 0 + STDOUT output = installed.
    • Exit code 0 + no STDOUT = not installed.
    • Wrap everything in try/catch and bias toward "not installed" on error so Intune retries.

    The pre-flight checklist

    Before clicking Add in the portal, verify:

    1. Install command tested on a clean VM (not your dev box)
    2. Uninstall command leaves no orphan files
    3. Detection rule survives the install/uninstall cycle
    4. Requirements scoped tightly
    5. Return codes map to actual installer behavior
    6. Pilot group assigned, broad assignment not yet created

    Generate the boilerplate automatically

    InstallMage outputs a Win32-ready .intunewin with the install command, uninstall command, and detection rule pre-formatted for direct paste into the Intune portal. Pro and MSP tiers also include the full deployment cheat sheet. See the .intunewin vs MSI breakdown for when to use each format, or our silent switch cheat sheet for the install commands themselves.

    Need volume deployments or custom workflows? Talk to our team about the MSP tier.

    Keep reading