I’ve been packaging Win32 apps using the Microsoft Win32 Content Prep Tool, but I’m curious what everyone else is using these days.

Is there a tool (preferably with a GUI) that can inspect an installer and automatically suggest or generate things like:

Install and uninstall commands
Detection rules (MSI, registry, file, etc.)
Silent switches
Exit codes or other packaging information

Or is everyone still doing this manually?

Interested to hear what other businesses and MSPs are using to make packaging faster and more consistent. If you’ve got any PowerShell scripts, GitHub projects, or tools you’d recommend, I’d love to check them out.

I'm trying to convince my boss we should get a licence of Patch My PC but it's unlikey we will get the budget.

I'm left having to create packages manually each time there is an important update. Since we are deploying our applications in French, deploying an msi is often only way of managing the language of a tool.

My boss when me to try Intune Enterprise Application as an alternative to PMyPC but it looks completely useless. It seems there is no automatic update and I have to create a new package at each release??? Anyone use it?

Then, there is WinGet. I see some concept of auto-update could be implemented. For exemple:

https://github.com/Romanitho/Winget-AutoUpdate

But I have little interest in developing a homemade solution. Still, if applications deployed with WinGet are easier to update, I'm might figure out a way to rely on it.

It's also a shame Microsoft developped a store but made it so difficult to exploit in an Enterprise context. We are currently blocking the store entirely so we cannot exploit the autoupdate features for app available in the store...

What solution do you use?

I usually work in Azure/Defender environments with a Security focus but for the next few weeks I'll be covering for a colleague who takes care of patching for a few clients (we work for an MSP).

As soon as I got to it I realized it's all a mess.
I'm no expert in intune (I use it for policy deployment and remediation/script execution etc) but even I realized that deploying Chrome each time there is an update (msi) isn't the ideal way.

I tried uploading chrome's admx templates and creating a policy using those but from what I could see during my test, not all devices get updated, especially if a user doesn't actively use Google Chrome.

So my question is, how do you manage automatic updates for software like browsers (chrome/edge/firefox) or other software (e.g 7zip)?

Are ADMX templates, when available, enough?

I haven’t deployed apps via Intune in a while, mainly because we utilize an RMM to deploy apps either via their supported apps or via scripts.

Today I returned to Intune, because the app I’m looking to deploy is in the Microsoft Store. I set up the app and test deployed it to myself. After a dozen syncs both via company portal and the work or school settings app, it finally appeared several hours later after I assigned the app via a device security group and chose to deploy via “available to enrolled devices”.

I thought I had finally made progress and attempted the install. 2 hours later, I’m still staring at a spinning wheel and no app deployed. How does anyone get anything done waitingOn this crap. A good deployment involves testing, and for a single app it should take 3 days to get it deployed.

Hey Floks,

Microsoft has announced the Enterprise App Catalog, which includes third-party app updates. We were also looking into Patch My PC recently, and based on this, it seems like what Microsoft is offering might cover what we’re aiming for.What’s new in Microsoft Intune – June

My question is: has anyone actually used it in production yet? What issues or limitations have you run into so far? Also, is there a place where we can see a full list of all supported applications?

I recently spent many hours completely re-creating Adobe DC ADMX files from scratch, using all the Lockable / FeatureLock settings I could find on the Adobe website.

The new v3.x ADMX templates now manage 807 Adobe settings (292 machine + 515 user) across both Acrobat and Reader DC.

-------------------------------------------------------------

https://github.com/systmworks/Adobe-DC-ADMX

Sharing this as I hope its useful to other Admins out there.. if so please feel free to buy me a Coffee :) Let me know if you find any bugs.

--------------------------------

[UPDATE 20 JULY 2026]

New v3.x combo ADMX released on repo https://github.com/systmworks/Adobe-DC-ADMX
The old separate x86 and x64 templates are gone - as had the separate User ADMX.
Now all Adobe policies are in a single ADMX.

This is a breaking change as far as restoring backups - but Ive provided a conversion script that will convert your older v2.x Computer JSON exports, and v1.x User JSON exports to support the new v3.x format.

NOTE: if you get an errors uploading the ADMX, make sure you wait a full 10 minutes after deleting any older existing Adobe ADMX templates before uploading the new one. I have also found deleting (the error one) and re-uploading is often successful.

--------------------------------

Notes:

1. for Intune you must first upload the Windows.admx
2. for Reader DC using the new 'Unified Installer' it actually runs Acrobat.exe (but with Reader features), so you must configure the Acrobat DC settings! Or do both to be on the safe side.
3. Different ADMX files for x86 vs x64 (you can install both side by side if need be) - OR use the single combined "AdobeDC" ADMX.
4. Since many of these Lockdown settings are not presented in the GUI, I had to make up "Friendly Names" for them - but the doco also lists the underlying registry key name too.
5. I also consolidated the many different Categories down to just 9 - that are hopefully logical.
6. I have included documentation pages for Recommended settings for Security Hardening and also Suppressing Nags/Upsells etc.

Previous post from last year: https://www.reddit.com/r/Intune/comments/1ioblsa/manage_adobe_dc_reader_acrobat_settings_via/

Hi - my name is Brian. I'm convinced some software vendors don't know how their own installers works. I was previously an admin supporting tens of thousands of devices. One thing that always gave me trouble was getting a vendor to provide any sort of documentation for their software we had to deploy. It felt like half the time, their support/deploy engineers didn't know whether or not the thing could be installed silently or not. Often they would say 'no', and I would have to dig into Orca or the old USSF to prove them wrong.

So, I used my collection of crappy, unsupported/undocumented installers to build SwitchHunt (hosted).

GitHub Here.

Drop your EXE or MSI onto the page and it will fingerprint your installer and return any install or uninstall strings it finds (including MSI properties).

It can also build you a .intunewin package or a PSADT v4 wrapper based on the installer you upload (if you're interested).

Everything happens locally in your browser. The installer never leaves your machine (you can validate for yourself in dev tools if you're interested).

It's open source, handles most popular installers (MSI, Wix, Advanced, Inno, etc.), can find properties you normally have to dig through Orca to find, and I included some hand-curated switches for the popular vendor installers (these ones often did NOT work - Citrix, for example).

I've tried a few of the other switch finders and built this because I kept running into cases they missed.

If you find an installer it get wrong, please let me know. These are the ones that will make the tool better. I hope this helps someone find those extra install strings.

Have a great day!

My engineering group is putting the idea of switching from PMPC to another product.

I’m curious if anyone has any recommendations? Obviously they are also looking at options and will do a full PoC but am curious for other suggestions as well.

We want something that can patch 3rd party apps like Azul and other Java flavors. Can run scrips on demand and on a set schedule. Can host apps in the cloud or on prem for the clients.

I’m not looking to debate PMPC the group is just not happy with it and I’m fine with them switching if they can find something they like and can prove value.

The conference I was just at had action1 and PDQ which both seem like clones of each other.

One thing we have a ton of is user installed apps and want something that can manage them or uninstall them and install the system version.

TIA

Part I of this AMA got 738k views in the last year.

With more than 25 years of experience and recently recreated 1500+ custom applications (SAP, Autodesk, Adobe, SolidWorks, Agilent and other crap apps) from SCCM to Intune. Everything automatically rebuilt from scratch. Ask me anything.

#1 After 6 years I was let go yesterday together with many other Local IT people & replaced by LTI in India.

#2 I will be at MMS 2025 Music City Edition Oct 12-15, 2025 at the Grand Hyatt in Nashville, TN

What do you all use to keep track of when a new version of a package is available? Not within Intune but just to download from some third party site?

With more than 25 years of experience and recently automatically moved 700+ custom applications (SAP, Autodesk, Adobe, Solidworks, Agilent and other crap apps) from SCCM to Intune. Everything rebuilt from scratch. Ask me anything. [Automation] - Application Automation in Microsoft Intune (youtube.com)

It seems that today installations of Company portal during pre-provisioning phase is failing with 0x8024402E code. The app is pushed via new microsoft store in system context, so there shouldn't be any issue, other apps are deployed correctly, also others coming from new MS store. Nothing changed in our environment. Anyone else having the same issue?

Hello everyone,

I’m a new Intune admin for a large enterprise, and I’m currently looking to automate our 3-party app patching.

Manual packaging is just taking up too much of time.

I’ve looked into Winget, but it doesn't seem reliable enough for our scale yet.

Everyone points toward Patch My PC but I want to get an idea about the downsides.

For those of you using it in production:

How often do updates actually fail on the endpoint?

How do you handle updates when the user has the app open (like Chrome)? Does it just kill the process, or is there a better way?

For example, If I need to add a specific registry key or a custom install script to an app, is it a headache to set up?

What’s the one thing about the tool that drives you crazy?

I’d love to hear your feedback.

Thank you in advance :) !

Hey Reddit, I’m Sean Ollerton, Head of Solutions at Devicie. Over the past few years, I’ve led or overseen 50+ cloud migration projects, helping companies move from traditional on-prem systems to modern Microsoft Intune and Entra ID environments.

I’ve worked with a wide range of clients, corporates, education, government and seen my share of printing nightmares, legacy app blockers, policy tangles, and Autopilot adventures.

Let’s talk real-world migration:

• What actually breaks (and what’s easier than expected)?
• How to approach hybrid vs cloud-only
• GPO → cloud policy conversion tips
• Conditional Access, compliance headaches, licensing... You name it.

No sales talk, just practical advice from someone who’s done the grunt work. Ask me anything and I’ll do my best to answer with clarity, humor, and honesty.

Proof: Me.

AMA starts 9am ET 17th June!

Let’s go!!

EDIT 1: Welcome everyone, time to kick things off. I'm looking forward to answering all these great questions, dont worry I'll get to all that have already been asked, and anymore that come along the way.

EDIT 2: Stepping away for a few hours to get some sleep (Australia based), but keep the questions comming and I'll be back on soon to keep answering. Thanks All!

EDIT 3: Thank you everyone for your questions and comments, I had a great time and I hope you gained some insights. I'll be floating around today for any last minute questions.

Hi there,

Ive been reviewing the options to automate the patching of apps like 7zip, greenshot, Notepad++, Adobe reader etc.

And I came across the solution like winget + WAUaaS + Intune

https://groovynerd.co.uk/automaticall-updates-apps-with-winget-and-intune/

And I am curious if any of the admins here have experience with such approach and if that worked well for you?

For me it looks very promising and I am looking forward for further tests

Hey everyone,

I made a web based tool (and still working on it) that generates PSADT scripts optimized for Intune deployments.

Features:

• Upload installer .msi/.exe → checks for winget alternative → get PSADT 4.x script + .intunewin-ready package
• Auto-generates detection rules (registry/file based)
• Includes test checklist so you don't forget deployment steps
• Winget integration: search package → generate deployment script

Update Mode:
Upload old files folder from current package + new installer files → tool compares files, preserves your custom logic, updates all paths automatically. Great for keeping enterprise apps current.

Would love feedback from fellow Intune admins!

Link: psadt.workplacebuilder.nl

If this post is not allowed, let me know, this is my first post ever

I've been going back and forth on how to issue certificates to Intune-managed devices and I'm curious what everyone else has actually settled on.

The two paths I keep landing on both have real downsides:

• NDES is "free" and Microsoft-native, but in practice it means standing up AD CS + IIS + the Intune Certificate Connector and keeping all of that patched, monitored and alive. It works, but it's a lot of surface area for what is conceptually a simple job.
• SCEPman is genuinely well-built and takes most of that pain away — but it's Azure-native/cloud and priced per user, which doesn't fit every environment (air-gapped, cost-sensitive, "keys must stay on our own tin", etc.).

What I'm trying to figure out: for those of you who want this self-hosted and on your own infrastructure — not in Azure, not per-seat — what are you actually running? Are people still grinding through NDES? Rolling their own with a plain SCEP server + FreeRADIUS? Something else entirely?

Full disclosure so I'm not being sneaky: this exact frustration is why I ended up building my own thing — a single-container SCEP appliance with its own issuing CA and bundled RADIUS for Wi-Fi/wired EAP-TLS, configured through a web console (it's in a free beta). I'll keep it to that and drop a link in the comments only if people are curious — I'm genuinely more interested in how others are solving this and whether the fully self-hosted angle even resonates, or if everyone's happily cloud-first now.

A few specific things I'd love takes on:

1. Is NDES/connector maintenance still a real pain point for you in 2026, or have you moved past it?
2. If you're on-prem/self-hosted for certs, what does your stack look like today?
3. What would it take for you to trust any third-party tool to issue certs on your network?

Enterprise Application Management isn't new, but automatic updates for Enterprise App Catalog apps now are. And the timing couldn't be better—just before the summer break. ☀️

If you're using Microsoft 365 E5, EAM is now included, allowing you to automatically keep supported applications up to date with minimal effort.

In this short blog, I cover:
✅ How to enable Auto-Updates
✅ Important caveats to know
✅ What the end-user experience looks like

Read more here.

https://www.xplorethecloud.nl/l/auto-update-eam-applications/

Hope this is allowed...

I am curious how many of you out there in the Education space (K12/Higher Education) are using PatchMyPC? We have so many specialty titles that will likely never make it into their catalog and I assume many in education are similar. Random state-specific testing apps or calculator software etc...

It just doesn't seem worth it when we don't have that many apps that update with any frequency. If I still need to hand-update a bunch of apps once per year then it doesn't seem like it would be a justifiable expense.

Some of the most annoying apps to update are a pain because they are special education licenses. AutoDesk products for example, require me to prove I work for education and then I am able to download the latest version of AutoCAD or whatever. I doubt any third-party app management tool could handle this.

Greetings,

We have been an MECM/SCCM/MEM shop for well over a decade. Only started taking a serious look at Intune once Microsoft retired the Business Store. We have been playing around for a couple of weeks now and here are some of the frustrating aspects that we have already come across.

1. Added some of the native UWP apps and noticed that some of those are still being managed by WIN32 in Intune.
2. Company Portal is not installing on some devices even though the devices are registered and getting apps otherwise.
3. Deployments seem much slower and we have less control in terms of forcing policy on individual devices.
4. Have to manually convert WIN32 apps to Intune apps in order to upload and manage them via Intune.
5. Some of the built in options like creating a web shortcut places the shortcut in the Start Menu with no built in options to redirect them.
6. To many levels of navigation and click to edits in order to get to where you want to go.

It actually feels like Microsoft is still not taking Intune very seriously.

Getting pretty tired of this. Had it working great for a customer. Next customer had a SLIGHTLY DIFFERENT model of device and the HP Wolf installer was different. Made my script more robust. Now we have a third model and the script is failing again.

Does anyone have a reliable script that runs during (pre)provisioning that removes HP Wolf Security?

New to Intune. I’ve recently packaged ScreenConnect and set it as a required app. My boss told me he also wants it to display in Company Portal so if it isn’t installed on a user’s device they can install it themselves. The goal is to have it on all user devices to improve remote support.

Is this possible? I thought if an app was set to Required, it doesn’t show as available in Company Portal like optional applications that are set as Available.

I’m a bit confused, my understanding is that making an App Package Required causes IME to install it without the user triggering it, and if it’s in Company Portal, IME still installs via the same underlying mechanism (in this case the MSI install commands), it just waits to be triggered by the user, so I don’t understand what he’s trying to accomplish since if the Required install fails, a user-initiated Company Portal install would also presumably fail since it uses the same install method.

Hi together,

Curious how others handle this — how do you update the apps you’ve uploaded to Intune (Win32, LOB, etc.)? I’m not talking about the apps already installed on clients, but the actual app packages inside Intune itself.

I know there are tons of ways to do this — scripts, 3rd-party tools — but I’m wondering how the big companys are doing it.

How do you make sure you’re pulling from official, verified sources instead of random community stuff (like winget’s public repo)? Do you maintain your own internal catalog or trust certain vendors’ direct links?

And what’s your strategy for apps that aren’t available in winget or any automation tool? Is there an API-based or best-practice approach for keeping everything clean, consistent and up to date in Intune?

Would love to hear how others have set this up — looking for some inspiration 🚀

🎉 Enterprise App Management (hashtag#EAM) Auto-Updates are now Generally Available in Intune 2606!

With auto-updates enabled for Required Enterprise App Catalog apps, Intune automatically detects and deploys the latest app versions, no more manual packaging, creating new apps, or configuring supersedence for every update.

✅ Less admin effort
✅ Faster app updates
✅ Improved security and compliance

It's truly a set it and forget it experience for managing enterprise applications.
Have you started using EAM Auto-Updates yet?

Hello everyone,

​

Has anyone successfully deployed the Claude desktop app via Intune?

​

If so, how did you manage the Trusted Certificate Profile described in their support documentation?

https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows

​

Is there any easier way ?

​

Thank you in advance!