Deploy Win32 Apps Using Native PowerShell Script Installer in Intune [Complete Guide]

What Is the PowerShell Script Installer for Win32 Apps in Intune?

The PowerShell Script Installer for Win32 Apps is a native capability in Microsoft Intune that allows administrators to upload and manage application installation and uninstallation PowerShell scripts directly within the Intune admin console. It decouples deployment scripting logic from the packaged .intunewin binary payload, eliminating the traditional requirement to re-wrap and re-upload large application source packages when adjusting script logic.

For years, deploying complex desktop applications through Microsoft Intune required packaging both the vendor binaries and the orchestration script (such as Deploy-Application.ps1 from the PSAppDeployToolkit) into a single encrypted .intunewin file using the Microsoft Win32 Content Prep Tool. If you needed to update a detection registry key, alter a command-line argument, or insert a pre-flight prerequisite check, you had to re-run the preparation tool and upload the entire multi-gigabyte payload back to Microsoft cloud storage.

With the release of native script installer support, Intune separates the installation logic from the application media. You upload your core software binaries inside a static .intunewin wrapper once, while dynamically configuring your installation script, uninstallation script, and execution parameters directly in the Intune portal.

Traditional Win32 Wrapping vs. Native PowerShell Script Installer

Understanding how the architectural boundary shifts between traditional Win32 app wrappers and the native script installer explains why this feature is essential for modern enterprise endpoint management:

Prerequisites and System Requirements

Before implementing the native script installer for enterprise production workloads, verify that your tenant and client endpoints meet the following environmental requirements:

• Microsoft Intune Service Release: Tenant running Service Release 2601 or higher.
• Operating System Support: Windows 11 (Home, Pro, Enterprise, Education) or Windows 10 (version 1607 and later).
• Intune Management Extension (IME): Active IME agent installed on the endpoint (provisions automatically upon initial Intune enrollment).
• PowerShell Version: Windows PowerShell 5.1 (default) or PowerShell 7.x (if configured on the host).
• Administrative Privileges: Intune Administrator, Cloud Device Administrator, or custom RBAC role with Device Apps / Read & Create permissions.

Step-by-Step Implementation Guide

Step 1: Create the Minimal Application Payload

Even though the orchestration script is managed independently, Intune still requires an .intunewin container to store the software installer binaries (such as vendor MSI, EXE, or support files).

1. Create a staging folder on your technician workstation: C:PackagesSource.
2. Place your setup binaries (e.g., setup.exe or app.msi) into the folder. Do not place your installation orchestration script here.
3. Download the latest version of the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe).
4. Open terminal and execute the preparation utility:

IntuneWinAppUtil.exe -c "C:PackagesSource" -s "setup.exe" -o "C:PackagesOutput" -q

Step 2: Configure the App in the Intune Admin Center

1. Sign in to the Microsoft Intune admin center.
2. Navigate to Apps > Windows > Add.
3. In the App type dropdown, select Windows app (Win32) and click Select.
4. Click Select app package file and upload your newly created .intunewin file from C:PackagesOutput.
5. Complete the standard app information fields (Name, Description, Publisher, Category, and Version) and click Next.

Step 3: Select the PowerShell Script Installer Type

Under the Program configuration tab, you will notice the enhanced installer interface:

1. Locate the Install experience or Installer type selector.
2. Change the selection from Command line to PowerShell script.
3. Upload your custom installation script (e.g., Install-Application.ps1).
4. Upload your custom uninstallation script (e.g., Uninstall-Application.ps1).
5. Set Install behavior to System (for machine-wide enterprise provisioning) or User (for per-user software).
6. Configure execution toggles:
   • Run script as 32-bit process on 64-bit clients: Set to No unless targeting legacy 32-bit registry hives or 32-bit COM libraries.
   • Enforce script signature check: Set to Yes if your environment enforces strict code signing with corporate PKI certificates; otherwise set to No.

Step 4: Set Up Accurate Detection Rules

The Intune Management Extension checks detection rules immediately after the script installer finishes execution. If the rule evaluates to false, Intune reports an installation failure even if the installer exited with code 0.

• File Detection: Target the absolute executable path (e.g., %ProgramFiles%VendorApplicationapp.exe) with detection method File or folder exists.
• Registry Detection: Target HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{AppGUID} and verify the DisplayVersion string value matches your baseline.

Production-Grade PowerShell Installer Wrapper

When running under Intune’s NT AUTHORITYSYSTEM account, standard interactive cmdlets will hang indefinitely. Production scripts require explicit working-directory resolution, structured logging compatible with CMTrace, and deterministic return codes.

Use the following enterprise template for your installation script:

<#
.SYNOPSIS
    Enterprise Win32 Application Installation Wrapper for Intune Native Script Installer
.DESCRIPTION
    Executes vendor setup in SYSTEM context, logs output to IME directory, and returns proper exit codes.
#>

[CmdletBinding()]
param()

# Setup Logging to Intune Management Extension Directory
$LogPath = "C:ProgramDataMicrosoftIntuneManagementExtensionLogs"
if (-not (Test-Path $LogPath)) { New-Item -Path $LogPath -ItemType Directory -Force | Out-Null }
$LogFile = Join-Path $LogPath "AppDeploy_Install.log"
Start-Transcript -Path $LogFile -Append -Force

try {
    Write-Host "[INFO] Initiating deployment via native Intune PowerShell Script Installer..." -ForegroundColor Cyan
    $SourceDir = $PSScriptRoot
    $Installer = Join-Path $SourceDir "setup.exe"

    if (-not (Test-Path $Installer)) {
        throw "Payload binary not found at path: $Installer"
    }

    Write-Host "[INFO] Executing vendor installer silently..."
    $Arguments = "/VERYSILENT /NORESTART /ALLUSERS"
    $Process = Start-Process -FilePath $Installer -ArgumentList $Arguments -Wait -PassThru -NoNewWindow

    Write-Host "[INFO] Process finished with Exit Code: $($Process.ExitCode)"
    
    # Evaluate Exit Codes (0 or 3010)
    if ($Process.ExitCode -eq 0 -or $Process.ExitCode -eq 3010) {
        Write-Host "[SUCCESS] Application deployed successfully." -ForegroundColor Green
        Stop-Transcript
        exit $Process.ExitCode
    } else {
        Write-Warning "[ERROR] Vendor installer returned failure exit code: $($Process.ExitCode)"
        Stop-Transcript
        exit $Process.ExitCode
    }
}
catch {
    Write-Error "[FATAL] Deployment script failed: $($_.Exception.Message)"
    Stop-Transcript
    exit 1
}

Troubleshooting Intune Management Extension Logs and Exit Codes

When an application deployed via the PowerShell Script Installer fails, inspect the client diagnostic logs directly on the endpoint.

Key Log Files to Review

1. IntuneManagementExtension.log: Located in C:ProgramDataMicrosoftIntuneManagementExtensionLogs. Tracks content download hashes, policy compliance, and whether the installer was triggered.
2. AgentExecutor.log: Contains the execution transcripts of PowerShell scripts executed by the IME agent. Review this file to capture raw standard error output generated during script runtime.
3. Custom Application Log: As configured in our template above, check C:ProgramDataMicrosoftIntuneManagementExtensionLogsAppDeploy_Install.log for line-by-line script milestones.

Handling Intune Return Codes

By default, Intune maps return codes to installation statuses under Program settings:

• 0 (Success): Application installed cleanly and passed detection.
• 1707 (Success): Successfully completed via internal handler.
• 3010 (Soft Reboot): Success, but system restart required before full functionality.
• 1641 (Hard Reboot): Installer initiated an immediate reboot.
• 1618 (Fast Retry): Another MSI installation is currently in progress. IME retries automatically.

For more troubleshooting strategies on endpoint agent logs and diagnostic tracing, refer to our comprehensive guide on Intune Management Extension Log Files and our deep dive on Deploying Win32 Apps Using Intune.

People Also Ask (PAA)

Can I update the script without re-uploading the .intunewin file?

Yes. That is the core advantage of the native PowerShell script installer. If you need to fix a script logic bug, alter an argument, or update registry settings, simply edit the app in the Intune admin center, upload the new .ps1 file under the Program tab, and save. Intune redistributes the script to targeted endpoints without downloading the heavy application package again.

Does the PowerShell script run as SYSTEM or User?

It depends on the Install behavior setting selected under the Program tab. If configured as System, the script runs under the NT AUTHORITYSYSTEM account with full elevated administrative privileges. If configured as User, it runs within the security context of the logged-on user.

Do I still need the Microsoft Win32 Content Prep Tool?

Yes. The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) is still required to package the vendor setup media (such as MSIs, EXEs, and data folders) into an encrypted .intunewin payload. However, you no longer need to package your orchestration script inside that file.

What execution policy does Intune use for the script installer?

The Intune Management Extension automatically launches PowerShell scripts with the -ExecutionPolicy Bypass parameter. This ensures your deployment script executes smoothly even if your tenant or group policy enforces a restrictive execution policy like Restricted or AllSigned (unless the signature check toggle is explicitly enforced in the portal).

Summary Checklist: Deploying Win32 Apps with Script Installer

Adopting the native PowerShell script installer modernizes enterprise application packaging workflows. Follow this checklist to ensure smooth production deployments:

• Package raw vendor binaries into .intunewin without internal scripts.
• Switch installer type to PowerShell script in the Intune Program configuration tab.
• Upload modular, hardened installation and uninstallation scripts with $PSScriptRoot references.
• Implement robust file or registry detection rules that verify the true state of the software.
• Configure centralized transcript logging into C:ProgramDataMicrosoftIntuneManagementExtensionLogs for rapid troubleshooting.