Win32 App Packaging, Detection Rules & ESP Blocking

Package legacy installers into .intunewin format using IntuneWinAppUtil, author custom PowerShell detection rules, and configure Enrollment Status Page blocking.

Tags:#Win32 Apps#intunewin#Detection Rules#ESP#Packaging#MD-102

Overview

Win32 Application Deployment via the Intune Management Extension (IME) is the most flexible and powerful application delivery mechanism in Microsoft Intune.

Any standard .exe, .msi, .bat, or PowerShell script can be pre-processed into an encrypted, compressed .intunewin package using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe). Intune handles installation commands, uninstallation strings, return codes, and executes Detection Rules to verify installation status.

---

When to Use

Scenario	Recommendation	Technical Rationale
Complex Installers / Dependencies	Use Win32 (.intunewin)	Supports multi-file directories, custom PowerShell detection scripts, and dependency chaining.
Simple Standalone MSI	Use Win32 (Preferred over LOB)	Modern best practice strongly recommends packaging MSIs as Win32 rather than Line-of-Business (LOB) to avoid mix-mode ESP deadlocks.
Autopilot OOBE Blocking Apps	Mandatory Win32	Only Win32 and modern Store apps should be assigned as ESP blocking apps during Autopilot.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Apps
    └── Windows
        └── Add
            └── App type: Windows app (Win32)

---

Step-by-Step Implementation

Step 1: Package Source Files using `IntuneWinAppUtil.exe`

PowerShell

# Syntax for Win32 Content Prep Tool:
.\IntuneWinAppUtil.exe -c "C:\AppSource\7Zip" -s "7z2301-x64.msi" -o "C:\AppOutput" -q
# Generates: C:\AppOutput\7z2301-x64.intunewin

Step 2: Upload to Microsoft Intune

In Intune Admin Center > Apps > Windows > Add > Windows app (Win32).
Select the generated .intunewin file.
Configure Program:

Install command: msiexec /i "7z2301-x64.msi" /qn /norestart
Uninstall command: msiexec /x "{23170F69-40C1-2702-2301-000001000000}" /qn
Install behavior: System (Installs as NT AUTHORITY\SYSTEM)
Device restart behavior: No specific action

Step 3: Configure Detection Rules

Choose Manually configure detection rules:

Rule format: File / MSI / Registry OR Custom Detection Script.
Example File Detection:
Path: C:\Program Files\7-Zip
File or folder: 7z.exe
Detection method: File or folder exists

---

PowerShell Custom Detection Script

PowerShell

# Custom PowerShell Detection Script Example (Must return Exit Code 0 and output text on success)
$AppPath = "C:\Program Files\ExampleApp\app.exe"
$MinVersion = [version]"2.5.0.0"

if (Test-Path $AppPath) {
    $InstalledVersion = [version](Get-Item $AppPath).VersionInfo.FileVersion
    if ($InstalledVersion -ge $MinVersion) {
        Write-Output "App detected with compliant version: $InstalledVersion"
        Exit 0 # Success: Intune considers the application INSTALLED
    }
}

# Failure: Exit with non-zero or return nothing
Write-Output "App not found or version is below baseline"
Exit 1 # Failure: Intune triggers installation

---

Diagnostic Logs

Log File	Path	Key Search Terms
IntuneManagementExtension.log	`C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\`	Search for `[Win32App]`, `ExitCode`, `DetectionRule`, or app GUID.
AgentExecutor.log	`C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\`	Contains raw standard output from PowerShell detection and requirement scripts.

---

Troubleshooting Matrix

Exit Code / Error	Meaning	Exact Resolution
`0x87D1041C`	Application installed, but the Detection Rule failed to detect it post-install.	Check your detection rule path, registry key, or custom script. Ensure the file actually exists where specified.
`1603` (MSI Fatal Error)	Generic MSI failure; common causes include insufficient permissions or reboot pending.	Review vendor MSI log by adding `/l*v C:\Install.log` to the install command.
`0x800705B4`	ESP Timeout during Autopilot enrollment due to slow app download or reboot hang.	Remove heavy apps from ESP blocking list or switch install context to System.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Critical Exam Traps:

Do NOT Mix LOB and Win32 Apps: Never assign both Line-of-Business (single MSI) apps and Win32 (.intunewin) apps during Autopilot ESP, as the two installer agents will conflict and cause timeout failures.
Detection Script Return Codes: A custom detection script indicates success by outputting text to STDOUT and returning Exit Code 0. Any non-zero exit code indicates the app is missing.

PREVIOUS TOPIC4.4 Assigned Access: Single-App & Multi-App Kiosk NEXT TOPIC5.2 Microsoft 365 Apps: Deployment & Update Channels