Deploy Win32 Apps Using Intune (.IntuneWin Packaging Guide for Enterprise IT)
What Is a Win32 App in Intune? (Quick Answer)
A Win32 app in Microsoft Intune is a traditional Windows desktop application packaged into an encrypted .intunewin format. Intune uses the Intune Management Extension to download, evaluate detection rules, and silently install these apps on devices using System or User context.
Introduction: What Is a Win32 App in Intune and Why It Still Matters
When people talk about modern Application management, they often jump straight to MSIX or Microsoft Store apps. In reality, most organizations still depend heavily on traditional Win32 applications. These are the classic Windows desktop apps that come as .exe , .msi , or custom installers built years ago. Here we will talk about how to Deploy Win32 apps using Intune.
Think about applications like:
VPN clients Finance and ERP tools Engineering software Printer utilities Firmware and driver tools In-house business apps
Almost all of these are Win32 apps.
Using Microsoft Intune, administrators can package and deploy these apps remotely, without visiting devices or asking users to install anything manually. When Win32 deployment is done correctly, it becomes reliable, silent, and fully manageable at scale.
This blog explains how to deploy Win32 apps using Intune, starting from packaging and ending with Deployment or remediation and troubleshooting using real-world logic, not just theory.
How Win32 Apps Actually Deploy Inside Intune (Behind the Scenes)
When you upload a .intunewin package:
1- The device downloads the encrypted package using the Intune Management Extension (IME). 2- Requirement rules are evaluated. 3- Detection rules check if the app already exists. 4- The install command runs in System or User context. 5- IME logs installation results and reports status back to Intune.
💡 Engineer Tip: Intune does not install apps directly. Everything flows through the Intune Management Extension service, which is why most troubleshooting happens in IME logs.
Intune App Types Comparison: Choosing the Right Deployment Method
Before jumping into Win32 packaging, it’s important to understand why Win32 is usually the best choice.
MSI Apps
MSI apps are simple and straightforward. Intune already understands how MSI installers work. However, MSI deployments have limitations:
Limited customization
No dependency handling
No supersedence
Detection tied to ProductCode (which can change)
MSI apps are fine for very basic deployments, but they quickly become restrictive in enterprise environments.
Win32 Apps
Win32 apps are the most flexible and powerful option in Intune.
With Win32 apps, you can:
Use EXE, MSI, or script-based installers
Control install and uninstall logic
Define advanced detection rules
Handle dependencies automatically
Replace older versions using supersedence
Deploy silently in System context
This flexibility is why Win32 apps are the preferred method for enterprise app deployment.
Microsoft Store Apps
Store apps are easy to deploy but limited:
Less control
Dependent on Store availability
Not suitable for many business apps
Line-of-Business (LOB) Apps
LOB apps are a legacy method and not recommended for new deployments. They lack modern features like detection rules and supersedence.
Bottom line: If you want control, reliability, and scalability, Win32 apps are the best option.
Packaging Applications with IntuneWin
Win32 apps cannot be uploaded directly to Intune. They must first be converted into a special encrypted format called .intunewin
This is done using the IntuneWin (Win32 Content Prep Tool).
Creating the .intunewin Package
Step 1: Prepare Your Source Content
Before you begin, you must gather your installation files and the necessary utility.
Download your software: Place your installer (e.g., logitech_dfu.exe) in a dedicated folder, such as C:\ScriptDFU.
Organize: Keep the tool in a separate folder (e.g., C:\IntuneWinAppUtil) to prevent it from being bundled into your application packageExample of preparing source files and the IntuneWinAppUtil tool before creating a .intunewin package for Win32 app deployment in Intune.
Step 2: Create the .intunewin Package
Intune cannot deploy raw .exe or .msi files directly; they must be converted into the encrypted .intunewin format.
Launch the Command Prompt as Administrator.
Navigate to your tool’s folder and run IntuneWinAppUtil.exe.
Provide the following inputs when prompted:
◦ Source Folder:C:\ScriptDFU
◦ Setup File:logitech_dfu.exe
◦ Output Folder:C:\ScriptDFU
◦ Catalog Folder: Type N.
The tool will compress and encrypt your files into a single package ready for upload.
Using IntuneWinAppUtil.exe in command prompt to package installer files into an encrypted .intunewin format for Win32 app deployment.
What happens here:
Intune encrypts the source files, Compresses everything into one package and Prepares metadata for Intune
Example of a successfully created .intunewin package after running the IntuneWinAppUtil tool for Win32 app deployment in Microsoft Intune.
Step 3: Upload and Configure App Information
Log into the Microsoft Intune admin center to register your new package.
Navigate to Apps > All apps > Add.
Select Windows app (Win32) as the app type. Choosing Windows app (Win32) in Intune before uploading the .intunewin package during Win32 app deployment setup.
Upload your .intunewin file and fill in the App Information tab:
◦ Publisher: Logitech.
◦ App Version: Helpful for future updates.
Uploading the .intunewin file and completing App Information settings when deploying a Win32 application using Microsoft Intune.
◦ Logo: Always specify a logo to help users identify the app in the Company Portal.
oStep 4: Define Program and Install Behavior
This step determines how the app executes on the user’s device.
Install Command:logitech_dfu.exe /available /list /fw_version /wait /pop-up /output c:\Script_DFU_Outputuser.txt /upgrade_latest. You may need to find the silent install parameters for different applications by using the vendor website.
Install Behavior: For apps which installs in logged on user’s profile context (e.g %Appdata%) use User. For Apps which installs in the device or system context(e.g. C:\ProgramFiles), use System.
Device Restart Behavior: Choose No specific action if you want to suppress reboots for MSI-based apps. Setting install command, uninstall command, and install behavior in the Intune Program settings tab during Win32 app deployment.
💡 Engineer Tip: Always test silent switches locally before packaging.
Step 5: Set Requirements and Detection Rules
Detection rules are vital; they tell Intune if the app is already installed so it doesn’t try to reinstall it unnecessarily.
Requirements: Specify 64-bit architecture and a minimum OS like Windows 10 1607.
Detection Rules: Manually configure a File rule. Path:C:\
◦ File:Script_DFU_Outputuser.txt ◦ Method: File or folder exists.
Example of configuring a file-based detection rule in Microsoft Intune to verify successful installation of a Win32 application.
Expert Tip: Avoid using MSI product codes for detection if the software auto-updates, as the GUID may change and trigger a “downgrade” loop.
Step 6: Dependency and Tags
On the Dependencies tab: Software dependencies are applications that must be installed before this application can be installed. Adjust if needed. Click Next
Dependencies tab in Microsoft Intune used to define prerequisite applications before deploying a Win32 app.
Scope tags configuration screen in Microsoft Intune used to control administrative visibility for Win32 app deployments.
Step 7: Assignments and Monitoring
When assigning the app to groups, consider the Deployment Intent. Always go for UAT testing with few users before scheduling the deployment to all production users/devices.
Available: Users can choose when to install via the Company Portal. This is highly recommended for firmware tools like Logitech Script DFU to prevent users from losing keyboard input during critical work.
Required: The app installs automatically.
Device install status dashboard in Microsoft Intune used to monitor Win32 app deployment success, failures, and installation progress.
Click on Create, At this point it will upload the .intunewin file to create our Intune Win32 App.
After deployment, monitor the Device Install Status in the portal to track successes or failures.
Detection Rule Strategies Used by Real Engineers
Choosing the wrong detection method causes most deployment failures.
Best practices:
Use File detection for firmware or script-based installs
Use Registry detection for version tracking
Avoid volatile paths like Temp folders
Advanced engineers often create detection scripts to validate multiple conditions instead of relying on single checks.
Common Win32 Packaging Mistakes That Break Deployments
Packaging unnecessary folders
Missing silent install switches Using incorrect install context Detection rules pointing to user profile paths during System installs
Ignoring exit codes like 3010 (soft reboot)
Troubleshooting Common Issues
If an installation fails, use these tools to find the root cause:
Log Collection: Use the Collect logs feature in the Intune portal.
Drill down into the Managed Apps for the failed system
Go To Devices -> All Devices -> Select the computer failed and then select Managed Apps Click on collect Logs and enter the path %temp%/xlog_logitech In a few minutes, the log file will be ready to download.
Using the Managed Apps section in Microsoft Intune to collect logs and investigate Win32 application installation failures.
Log Paths: Check C:\ProgramData\Microsoft\IntuneManagementExtension\Logs for the AppWorkload.log (Win32 specific) and IntuneManagementExtension.log.
Exit Codes: A code of 0 is a success; 3010 indicates a restart is required.
Conclusion
Win32 app deployment remains the most powerful and reliable way to manage enterprise Windows applications in Intune. Once you understand packaging, detection rules, and Intune Management Extension workflow, deployments become predictable and scalable.
Mastering how to deploy Win32 apps using Intune gives you full lifecycle control over enterprise software delivery.
FAQ – Win32 App Deployment in Intune
1. What is a Win32 app in Microsoft Intune?
A Win32 app in Intune is a traditional Windows desktop application, usually delivered as an EXE or MSI installer. These apps are packaged into a intunewin file so Intune can install them silently, track installation status, and manage them across devices.
2. Why should I use Win32 apps instead of MSI apps in Intune?
Win32 apps give you much more control than MSI apps. With Win32 deployment, you can use custom install commands, run PowerShell scripts, handle complex installers, and define advanced detection rules. This makes Win32 apps the better choice for most enterprise applications.
3. What are detection rules and why are they important?
Detection rules tell Intune how to check whether an app is already installed on a device. If the detection rule is wrong, Intune may keep reinstalling the app or mark it as failed even when it works. Correct detection rules are the key to reliable Win32 app deployment.
4. Where can I find logs when a Win32 app fails to install?
When a Win32 app fails, logs are stored on the device at: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs The IntuneManagementExtension.log and AppWorkload.log files usually explain exactly why the installation failed.
5. What is IntuneWinAppUtil?
It’s Microsoft’s Win32 Content Prep Tool used to convert EXE or MSI installers into the encrypted .intunewin format required by Intune.
Deploy Win32 Apps Using Intune – Step-by-Step .IntuneWin Packaging & Deployment Guide (2026)
Table of content
How to Package and Deploy Win32 Apps using Intune
Deploy Win32 Apps Using Intune (.IntuneWin Packaging Guide for Enterprise IT)
What Is a Win32 App in Intune? (Quick Answer)
A Win32 app in Microsoft Intune is a traditional Windows desktop application packaged into an encrypted .intunewin format. Intune uses the Intune Management Extension to download, evaluate detection rules, and silently install these apps on devices using System or User context.
Introduction: What Is a Win32 App in Intune and Why It Still Matters
When people talk about modern Application management, they often jump straight to MSIX or Microsoft Store apps. In reality, most organizations still depend heavily on traditional Win32 applications. These are the classic Windows desktop apps that come as .exe , .msi , or custom installers built years ago. Here we will talk about how to Deploy Win32 apps using Intune.
Think about applications like:
VPN clients
Finance and ERP tools
Engineering software
Printer utilities
Firmware and driver tools
In-house business apps
Almost all of these are Win32 apps.
Using Microsoft Intune, administrators can package and deploy these apps remotely, without visiting devices or asking users to install anything manually. When Win32 deployment is done correctly, it becomes reliable, silent, and fully manageable at scale.
This blog explains how to deploy Win32 apps using Intune, starting from packaging and ending with Deployment or remediation and troubleshooting using real-world logic, not just theory.
How Win32 Apps Actually Deploy Inside Intune (Behind the Scenes)
When you upload a .intunewin package:
1- The device downloads the encrypted package using the Intune Management Extension (IME).
2- Requirement rules are evaluated.
3- Detection rules check if the app already exists.
4- The install command runs in System or User context.
5- IME logs installation results and reports status back to Intune.
💡 Engineer Tip:
Intune does not install apps directly. Everything flows through the Intune Management Extension service, which is why most troubleshooting happens in IME logs.
Intune App Types Comparison: Choosing the Right Deployment Method
Before jumping into Win32 packaging, it’s important to understand why Win32 is usually the best choice.
MSI Apps
MSI apps are simple and straightforward. Intune already understands how MSI installers work. However, MSI deployments have limitations:
Limited customization
No dependency handling
No supersedence
Detection tied to ProductCode (which can change)
MSI apps are fine for very basic deployments, but they quickly become restrictive in enterprise environments.
Win32 Apps
Win32 apps are the most flexible and powerful option in Intune.
With Win32 apps, you can:
Use EXE, MSI, or script-based installers
Control install and uninstall logic
Define advanced detection rules
Handle dependencies automatically
Replace older versions using supersedence
Deploy silently in System context
This flexibility is why Win32 apps are the preferred method for enterprise app deployment.
Microsoft Store Apps
Store apps are easy to deploy but limited:
Less control
Dependent on Store availability
Not suitable for many business apps
Line-of-Business (LOB) Apps
LOB apps are a legacy method and not recommended for new deployments. They lack modern features like detection rules and supersedence.
Bottom line:
If you want control, reliability, and scalability, Win32 apps are the best option.
Packaging Applications with IntuneWin
Win32 apps cannot be uploaded directly to Intune. They must first be converted into a special encrypted format called .intunewin
This is done using the IntuneWin (Win32 Content Prep Tool).
Creating the .intunewin Package
Step 1: Prepare Your Source Content
Before you begin, you must gather your installation files and the necessary utility.
Step 2: Create the .intunewin Package
Intune cannot deploy raw .exe or .msi files directly; they must be converted into the encrypted .intunewin format.
◦ Source Folder: C:\ScriptDFU
◦ Setup File: logitech_dfu.exe
◦ Output Folder: C:\ScriptDFU
◦ Catalog Folder: Type N.
The tool will compress and encrypt your files into a single package ready for upload.
What happens here:
Intune encrypts the source files, Compresses everything into one package and Prepares metadata for Intune
Step 3: Upload and Configure App Information
Log into the Microsoft Intune admin center to register your new package.
◦ Publisher: Logitech.
◦ App Version: Helpful for future updates.
◦ Logo: Always specify a logo to help users identify the app in the Company Portal.
oStep 4: Define Program and Install Behavior
This step determines how the app executes on the user’s device.
💡 Engineer Tip:
Always test silent switches locally before packaging.
Step 5: Set Requirements and Detection Rules
Detection rules are vital; they tell Intune if the app is already installed so it doesn’t try to reinstall it unnecessarily.
Path: C:\
◦ File: Script_DFU_Outputuser.txt
◦ Method: File or folder exists.
Expert Tip: Avoid using MSI product codes for detection if the software auto-updates, as the GUID may change and trigger a “downgrade” loop.
Step 6: Dependency and Tags
Step 7: Assignments and Monitoring
When assigning the app to groups, consider the Deployment Intent. Always go for UAT testing with few users before scheduling the deployment to all production users/devices.
Click on Create, At this point it will upload the .intunewin file to create our Intune Win32 App.
After deployment, monitor the Device Install Status in the portal to track successes or failures.
Detection Rule Strategies Used by Real Engineers
Choosing the wrong detection method causes most deployment failures.
Best practices:
Use File detection for firmware or script-based installs
Use Registry detection for version tracking
Avoid volatile paths like Temp folders
Advanced engineers often create detection scripts to validate multiple conditions instead of relying on single checks.
Common Win32 Packaging Mistakes That Break Deployments
Packaging unnecessary folders
Using incorrect install context
Detection rules pointing to user profile paths during System installs
Ignoring exit codes like 3010 (soft reboot)
Troubleshooting Common Issues
If an installation fails, use these tools to find the root cause:
Go To Devices -> All Devices -> Select the computer failed and then select Managed Apps
Click on collect Logs and enter the path %temp%/xlog_logitech In a few minutes, the log file will be ready to download.
Conclusion
Win32 app deployment remains the most powerful and reliable way to manage enterprise Windows applications in Intune. Once you understand packaging, detection rules, and Intune Management Extension workflow, deployments become predictable and scalable.
Mastering how to deploy Win32 apps using Intune gives you full lifecycle control over enterprise software delivery.
FAQ – Win32 App Deployment in Intune
1. What is a Win32 app in Microsoft Intune?
A Win32 app in Intune is a traditional Windows desktop application, usually delivered as an EXE or MSI installer. These apps are packaged into a intunewin file so Intune can install them silently, track installation status, and manage them across devices.
2. Why should I use Win32 apps instead of MSI apps in Intune?
Win32 apps give you much more control than MSI apps. With Win32 deployment, you can use custom install commands, run PowerShell scripts, handle complex installers, and define advanced detection rules. This makes Win32 apps the better choice for most enterprise applications.
3. What are detection rules and why are they important?
Detection rules tell Intune how to check whether an app is already installed on a device. If the detection rule is wrong, Intune may keep reinstalling the app or mark it as failed even when it works. Correct detection rules are the key to reliable Win32 app deployment.
4. Where can I find logs when a Win32 app fails to install?
When a Win32 app fails, logs are stored on the device at:
C:\ProgramData\Microsoft\IntuneManagementExtension\LogsThe IntuneManagementExtension.log and AppWorkload.log files usually explain exactly why the installation failed.
5. What is IntuneWinAppUtil?
It’s Microsoft’s Win32 Content Prep Tool used to convert EXE or MSI installers into the encrypted .intunewin format required by Intune.
Table of content
Subscribe to Blog
Signup to our weekly newsletter
category
Connect with Us
Recommended Posts
Deploy Win32 Apps Using Intune – Step-by-Step .IntuneWin Packaging & Deployment Guide (2026)
Planning for Distribution Points in SCCM
What Is a Distribution Point in SCCM / MECM?