Intune Deployment Cheat Sheet: Install, Uninstall & Detection Commands for 2026

Most failed Intune deployments trace back to the same three problems: wrong install command, missing uninstall string, and a detection rule that never fires. This cheat sheet gives you the exact commands and patterns to fix all three.

Bookmark it. You'll use it every week.

Install Commands

Win32 App Install Command Pattern

For a .intunewin package wrapping an EXE, your install command looks like this:

setup.exe /S /NORESTART

The specific silent switch depends on the installer framework. Get it wrong and you get a UAC prompt on every endpoint — or worse, a silent failure that reports success.

Silent Switches by Installer Framework

Gotcha: NSIS /S is case-sensitive. A lowercase /s starts an interactive install. You will not get an error — the install will just pop a UI on the endpoint.

Gotcha: InstallShield's /s alone is not enough. Without passing /qn through the /v flag, you get a silent launch with a visible progress dialog. Intune treats that as interactive.

If you do not know which framework packaged the EXE you are deploying, check the silent install switches guide for identification methods. Or let InstallMage detect it automatically during conversion.

Install Context: System vs. User

Always deploy Win32 apps in System context unless the app explicitly requires per-user installation. System context runs as SYSTEM, installs to C:\Program Files, and applies to all users on the endpoint.

Gotcha: Deploy in User context when the app writes to HKLM, and the install will fail silently on any endpoint where the logged-in user lacks elevation rights.

Uninstall Commands

MSI Uninstall

msiexec /x {PRODUCTCODE-GUID} /qn /norestart

Replace {PRODUCTCODE-GUID} with the actual ProductCode from the MSI database. Pull it with Orca, PowerShell, or directly from the registry:

HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\

Gotcha: ProductCodes change between versions. Reuse the old ProductCode after an MSI update and Intune will report success while the old version stays installed.

EXE Uninstall

For EXE-based apps, the uninstall string lives in the same Uninstall registry key. It typically looks like:

"C:\Program Files\AppName\uninstall.exe" /S

Or for Inno Setup:

"C:\Program Files\AppName\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES

Pull the exact string from a reference endpoint before you build your Intune app. Do not guess.

WiX MSI Wrapper Uninstall

If you used InstallMage to wrap an EXE into a WiX-compiled MSI, the uninstall string is generated automatically as part of the output. Paste it directly into the Intune app configuration. No registry hunting required.

Detection Rules

Detection rules are where most deployments break silently. Intune uses them to determine whether an app is installed. If the rule does not match the installed state, Intune either reinstalls the app in a loop or never marks it compliant.

File Detection

Path: C:\Program Files\AppName\
File or folder: app.exe
Detection method: File or folder exists

Use this when the app always installs to the same path and the file name does not change between versions. Simple and reliable for most cases.

For version-specific detection:

Path: C:\Program Files\AppName\
File or folder: app.exe
Detection method: String comparison
Property: File version
Operator: Greater than or equal to
Value: 5.2.0

Registry Detection

Key path: HKEY_LOCAL_MACHINE\SOFTWARE\AppName
Value name: Version
Detection method: String comparison
Operator: Equals
Value: 5.2.0

Use registry detection when the app writes a reliable version key. More precise than file detection for apps that update in place without changing the binary path.

Gotcha: 32-bit apps on 64-bit Windows write to HKLM\SOFTWARE\WOW6432Node, not HKLM\SOFTWARE. Target the wrong hive and the detection rule never fires — Intune will reinstall the app on every check-in cycle.

MSI ProductCode Detection

Detection method: MSI
ProductCode: {YOUR-GUID-HERE}

The most reliable option for MSI packages. Intune queries the Windows Installer database directly — no path dependency, no registry ambiguity.

Gotcha: This only works for true MSI installs. If you wrapped an EXE in a WiX MSI, the ProductCode is the GUID of the wrapper, not the inner EXE. Use the correct GUID from the wrapper.

For a deeper look at when to use MSI versus .intunewin and how detection rules differ between them, see Intunewin vs MSI Explained.

Return Codes

Intune interprets exit codes from your install command. Get these wrong and every successful install reports as a failure.

If your EXE returns a non-standard success code — some apps return 1 or 2 on a clean install — add it to the Return codes section in the Intune app configuration. Do not leave the default set and wonder why compliant endpoints show as failed.

Requirement Rules Worth Setting

These are not optional on a mixed fleet.

• OS architecture: Set to 64-bit unless you are explicitly targeting 32-bit endpoints.
• Minimum OS version: Match your fleet's minimum supported build. Windows 11 22H2 is the practical floor for most environments in 2026.
• Disk space: Set a minimum if the installer is large. Prevents failures on endpoints with full disks that otherwise look healthy.

The Last-Mile Problem: Detection GUIDs and Uninstall Strings

The commands above cover the standard cases. What burns the most time is building them from scratch for every new EXE you need to deploy.

For MSI packages, the workflow is straightforward. For raw EXE installers, you are identifying the framework, hunting the silent switch, finding the uninstall string in the registry, and manually building a detection rule. That is 30 to 90 minutes per package, every time.

InstallMage automates that entire chain. Upload the EXE, and the AI engine identifies the installer framework (Inno Setup, NSIS, InstallShield), extracts the correct silent arguments, compiles a WiX-based MSI wrapper, and outputs ready-to-paste install commands, uninstall strings, and detection rule GUIDs. The full pipeline completes in under 3 minutes.

The Starter tier is free with 3 conversions per month. No credit card required. For the full picture on Intune deployment best practices beyond packaging — assignment groups, supersedence, dependency configuration — the Intune Win32 best-practices guide has you covered.

Quick Reference: Commands at a Glance

Install

# Inno Setup
setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART

# NSIS
setup.exe /S

# InstallShield
setup.exe /s /v"/qn REBOOT=ReallySuppress"

# MSI
msiexec /i app.msi /qn /norestart

Uninstall

# MSI by ProductCode
msiexec /x {PRODUCTCODE-GUID} /qn /norestart

# Inno Setup EXE
"C:\Program Files\AppName\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES

# Generic EXE
"C:\Program Files\AppName\uninstall.exe" /S

Detection (PowerShell script method when rules fall short)

$path = "C:\Program Files\AppName\app.exe"
if (Test-Path $path) {
    $version = (Get-Item $path).VersionInfo.FileVersion
    if ([version]$version -ge [version]"5.2.0") {
        Write-Output "Installed"
        exit 0
    }
}
exit 1

Use the PowerShell detection method when file and registry rules cannot handle version logic precisely enough. Exit 0 with output means detected. Exit 1 means not detected. For a deeper dive into when to use each detection type, see Intune Win32 detection: script vs registry vs file.

FAQs

What is the correct silent install switch for an Inno Setup installer?

Use /VERYSILENT /SUPPRESSMSGBOXES /NORESTART. The /VERYSILENT flag suppresses all dialogs including the progress window. /SUPPRESSMSGBOXES prevents error popups from halting the install silently. /NORESTART blocks an automatic reboot — which matters in Intune deployments where you control reboot behavior separately.

Why does my Intune detection rule never fire even though the app is installed?

The most common cause is a 32-bit vs. 64-bit registry hive mismatch. 32-bit apps on 64-bit Windows write to HKLM\SOFTWARE\WOW6432Node, not HKLM\SOFTWARE. Check the actual registry path on a reference endpoint before building the detection rule.

What is the difference between exit code 0 and exit code 3010 in Intune?

Both indicate a successful install. Exit code 3010 means the install succeeded but a reboot is required to complete configuration. Intune marks the app as installed in both cases. Whether a reboot triggers depends on your device restart behavior settings in the assignment.

Can I use MSI ProductCode detection for an EXE wrapped into an MSI?

Yes, but use the ProductCode of the MSI wrapper — not the inner EXE. The wrapper is what Windows Installer registers. If you used InstallMage to generate the WiX MSI wrapper, the ProductCode GUID is included in the output alongside the install and uninstall commands.

What happens if I deploy in User context instead of System context by mistake?

The install runs under the logged-in user's account. If the app writes to HKLM or C:\Program Files, it will fail on standard user accounts without elevation. The Intune management extension will report failure, but the error message is often generic. Default to System context for Win32 apps unless the vendor explicitly documents a per-user install requirement.

How do I find the uninstall string for an EXE-based app already installed on an endpoint?

Query the registry at HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ and HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\. The UninstallString value gives you the exact command. Append a silent flag (usually /S or /VERYSILENT) and test on a non-production endpoint before deploying.

Why use InstallMage instead of just the Microsoft Win32 Content Prep Tool?

The Win32 Content Prep Tool wraps files into .intunewin. That is all it does. It does not detect silent switches, does not generate MSI wrappers, and does not produce detection rule GUIDs or uninstall strings. InstallMage does all of that automatically. For a raw EXE with an unknown installer framework, the Prep Tool gets you a wrapped file you still cannot deploy correctly. InstallMage gets you a deployable package with every command you need, ready to paste.

Save this page. The commands above cover 90% of what you will encounter in a standard Intune environment. For the edge cases, the PowerShell detection pattern and the registry lookup method handle the rest. Start converting EXEs for free when you are ready to skip the manual workflow.