A couple of weeks ago I managed to get my first deployment of executables to work with Microsoft Intune. This approach not only allows for deployment of EXE files but also MSI files alongside other files like DLL, CAB and MSP files. Basically building a deployment package that can be distributed by using Microsoft Intune and Microsoft Azure blob storage. The solution is not the most beautiful in the world by far, but it seems to do the job which is the important part until Microsoft provides a better solution for the community.
The solution is using a combination of Microsoft Azure blob storage and the newly introduced PowerShell script support in Intune (Also known as Project Sidecar). We will be able to use a PowerShell scripted deployment on the clients like many admins have done for many years in Active Directory using either a Batch, VBScript or PowerShell in Group Policies.
The PowerShell scripts showned in this article are intentionally fairly basic, but you can add your own logic into the script to check for whether the software is already installed, previous installations or any pre-requistes on the client.
<Will be posted at a later time…. >
- You need a Microsoft Azure Subscription for using Azure Storage Account
- You are using Windows 10 version 1607 or later
- You have a Microsoft Intune subscription
- Device needs to be Azure AD Joined
The following steps provides guidence on how to configure your Azure storage account for storing your setup files.
- Create a Microsoft Azure Storage Account.
- Within the newly created storage account create a new “container”.
- Upload the Installer/Package you need to deploy.
- Create a new “Shared Access Signature“.
- Combine this SAS with the URL for your package and test that you can download the package with your package from a browser. ex. https://intune.blob.core.windows.net/installers/DropboxEnterprise.exe?sv=2017-04-17&ss=b&srt=sco&sp=rl&se=2067-11-21T20:40:45Z&st=2017-11-21T09:40:45Z&spr=https&sig=NhEIL2IZwmq3hEzG1svw%2BYHwk%3D.
- Modify either the PowerShell script for single file executable deployment or package deployment witih multiple files.
- Import the script into Microsoft Intune PowerShell script.
- Assign the PowerShell script to a group.
- Wait for the magic to happen on the clients.
Dropbox PowerShell Script example:
$Path = $env:TEMP
$Installer = "dropbox_installer.exe"
Invoke-WebRequest "https://intune.blob.core.windows.net/installers/DropboxEnterprise.exe?sv=2017-04-17&ss=b&srt=sco&sp=rl&se=2067-11-21T20:40:45Z&st=2017-11-21T09:40:45Z&spr=https&sig=NhEIL2IZwmq3hEzG1svw%2BYHwk%3D" -OutFile $Path\$Installer
Start-Process -FilePath $Path\$Installer -Args "/S" -Verb RunAs -Wait
Other examples can be found here:
- Install Dropbox (Single file)
- Install SilverLight (Single file)
- Install Microsoft Cloud App Discovery Endpoint Agent (Package)
For the solution to work as expected you need to have the “Microsoft Intune Management Extension” installed on the client. The extension is automatic installed by Microsoft Intune and should be in “App/Remove Programs”. You can see that Microsoft Intune will download a temporary copy of the PowerShell script to the folder “C:\Program Files (x86)\Microsoft Intune Management Extension\Policies\Script” during execution of the PowerShell.
You should also take a look at the blog post by Oliver Kieselbach: https://oliverkieselbach.wordpress.com/2017/11/29/deep-dive-microsoft-intune-management-extension-powershell-scripts/.
A BIG THANKS for some great input to Per Larsen.
Peter van der Woude made a greate article on Chocolatey: “Combining the powers of the Intune Management Extension and Chocolatey”
Aaron Parker wrote a blog post on deployment of the Citrix Receiver: “Deploy Citrix Receiver to Windows 10 with Intune and PowerShell”
Another approach would be to use NuGet packages and deploy them using Chocolatey as mentioned by both Per Larsen and Lars Krogh.
I store my packages in gitlab. The nuget packages include binaries for the install. This will give me source and version control + backup. The packages gets pushed to https://t.co/p6sWKlnQem, if tests succeed (Pester) (you could also use azurewebsites).
— Lars Krogh (@OSDTips) December 12, 2017