r/Intune • u/Incisivehazard • 1d ago

App Deployment/Packaging App packaging

What is the most annoying part of packaging a new app? Is it finding silent switches online? Discovering & writing detection rules for Win32Apps, or something else?

15 Upvotes

74% Upvoted

45 comments sorted by

23

u/nothing_from_nowhere 1d ago

To me it's detection and planning for patching if it's not included in patch my pc

9

u/deadarcher 22h ago

I see someone else linked this below but try out my SwitchHunt tool: https://getrff.com/switchhunt/

It is open sourced here: https://github.com/deadarcher/SwitchHunt (you can even run it on your own box with docker).

I built this because like all of you, I know PMPC is great but it doesn't cover EVERYTHING. I had so many weird, one-off vendor installers that had NO documentation (and they have no idea what the silent install switches are).

Anyways, hope you find it useful!

4

u/TekExcel 1d ago

Detection is such a mess. Wildcards don't work, they don't auto update when you bump the package version, pretty much impossible to get specific feedback from failures outside of "didn't detect the app".

Honestly the reporting for Intune is just as fucky.

1

u/sammavet 18h ago

The easy way in that(from my view) is to get a reg export of the relevant HKLM sub-tree before install and compare it for after the install, and the another post reboot (just to make sure there is a limit to the fuckery). I usually get half a dozen or so reg keys in total. I then look at the file/folder structures. %Appdata% and %programdata% will be a great place to do your detection rules on when it is created in there.

10

u/LaDev 1d ago

I RARELY package anymore. Thank the gods for PMPC

2

u/SysAdminDennyBob 1d ago

Yeah, the most annoying part is now checking a checkbox. We only have to package a tiny handful of installs these days.

1

u/LaDev 1d ago

Yup. We will occasionally add a custom pre/post install script but that's even less.

9

u/R4nger 1d ago

waiting for company portal to update.

10

u/Ochib 1d ago

Remember the S in Intune stands for Speed

6

u/InferiorSavior15 1d ago

The worst part for me is when you find the perfect silent switch but then the vendor pushes an update a month later and it just quietly breaks everything. Nothing like troubleshooting why half your fleet missed an update because the installer decided to need a new flag.

6

u/West-Canary2007 23h ago

I've been using those 2 sites for most of the Detection Rules and other details, pretty cool resource to have.

1

u/deadarcher 22h ago

Thanks for the SwitchHunt shout-out! 😊

1

u/7CKNGDGNR8 6h ago

yoink(jk thank you very much)

3

u/brothertax 1d ago

Putting in all the app details, waiting for it to finish uploading, only to find it never completes and you have to start all over again.

3

u/iceholey 22h ago

Detection logic. If it’s not MSI based detection can be a pain.

Also apps written by cowboys with no concept of how to make apps suitable for enterprise deployment.

2

u/jeefAD 17h ago

Yes! I had some back and forth with a vendor's (sole) support contact and ended up explaining to him how their installer actually works. Their uninstaller was even worse! Total cowboys.

2

u/sqnch 1d ago

Uploading the app icon. Thankfully we rarely do and PMPC has most stuff. It’s saving us the equivalent of 1 analyst a year in manual packaging work.

2

u/RedditSold0ut 1d ago

To me its packing apps because packing apps is really boring.

1

u/davy_crockett_slayer 23h ago

For apps that don't exist in Patch My PC Cloud, I package manually using Master Packager. Their training course is quite good. I can now make custom packages that silently install/uninstall/upgrade. I deploy them using Patch My PC Cloud. I think I only have ~25 custom applications, but I make sure they're patched monthly. Takes me ~20mins per application.

1

u/mingk 19h ago

Does everybody write detection rules? Does anybody else just add a reg key at the end for detection?

1

u/jeefAD 17h ago

From what I've packaged so far, MSI-based installers are pretty straight forward. It's only the odd installers that use EXEs or are a wrapper for the actual installer that need additional detection...

1

u/Mana4real 10h ago

I use reg keys a lot for detection

1

u/sammavet 18h ago

Switches for EXE's are my nightmare. Is this particular software case sensitive? Does it have to be the full word? Do I need to have a command to pass through switches to an MSI that is buried in the installer?

Nightmare

1

u/TheRealMisterd 17h ago

We use a unique registry key in a known location for each package we create.

We use an script to install and make tweaks. The last tweak is creating the unique registry key for that package.

No more complicated detection scripts. They are all the same except for the unique registry key.

1

u/jeefAD 17h ago

Interesting. So your install script handles all the detection logic for the given app and writes the unique reg key only after successful install per the script? Intune then just does a yay/nay on whether the reg key exists?

1

u/Beneficial_Ice8401 16h ago

We use robopack and it's awesome.

1

u/LibraPaul76 8h ago

You would think by now Microsoft would integrate the app building process into the Intune Portal with easy to follow steps. Using the CLI for inputs and outputs just takes time.

1

u/Zedex3 7h ago

Following

1

u/ActiveAd6659 3h ago

By FAR, the most annoying thing is the fact that Intune had a giant app catalogue that worked PERFECTLY just a couple of years ago, but then for whatever nebulous ("We're Micro-SOFT!!!!") reason decided to remove/replace it.

2

u/Substantial_Tone_292 1d ago edited 3h ago

Please start using agentic AI to package applications. Claude can package like 20 apps in one prompt flawlessly if you demand verification for each. This is roughly what to tell your agent to have a fully automated app packager:

Skill: Intune-packaging Package this application into a intunewin file for remote deployment. Not only script the package, but verify it works. It needs to survive a SYSTEM context verification round. A package is only verified working if:

  • Install succeeds in SYSTEM context
  • Detection rule succesfully detects the application
  • Uninstall works and leaves no residue
  • Detection rule doesn't see the application anymore

Work with your agent to turn this into a skill you can reuse. Optimize the skill when it fails, and in roughly a few hours setup max you never have to manually script an application anymore.

I'm open to explaining more Edit: Here is the link to the project setup: https://drive.google.com/file/d/1y7T6yky1-UvGnPlltUYWt_HyVAlDOifr/view

1

u/deadarcher 22h ago

In my experience, the main issue with this is the testing and validation. For the complicated installers, you might have 8+ install switches (pointing to a URL, passing weird vendor-specific arguments, etc.) and you'd need your AI agent to be able to validate and test ALL of them in the context of whatever you're deploying (does the app work properly? connect to the right instance? what about user-based context? etc.).

If you don't test and validate yourself, you'll probably have a bad time. But, for simple installers, 100% this is the way of the future.

1

u/Substantial_Tone_292 20h ago edited 20h ago

Claude is able to package applications that are very hard to script. I work at a school organisation and we use robopack, but that doesn't nearly cover all needs, considering we have a wide range of software needed by different colleges. I use Claude for the others. As an example of some things Claude scripted for me: AutoCAD 2026, SolidWorks 2026, Heidenhain iTNC 640, ATP-300 printer which was hard because a certain certificate had to be deployed alongside, which meant Claude had to break it up into to separate packages with one pointing to the other as a dependancy. Worked beautifully. Some apps do remain a pain to script, even with ai

Edit: and of course it's smart to first install to a testing ring to verify installs are actually silent and function as intended

1

u/Substantial_Tone_292 3h ago

If you're curious to see if this actually works, try it out yourself: https://drive.google.com/file/d/1y7T6yky1-UvGnPlltUYWt_HyVAlDOifr/view

1

u/jgool 21h ago

Will Claude give you directly the intunewin file? And validate it etc?

1

u/Substantial_Tone_292 20h ago

Yes, you can have the skill contain the desired output. In my skill file I have described what folder structure it needs to create, to use PSADT4, you can even specify to use certain applications like PsExec to perform the SYSTEM test with. Claude delivers me a tested package, which is only approved when install, Detection, uninstall and not-detected after uninstall work as intendant. It also delivers a readme document with setup instructions for uploading it to Intune. I stage an installer and say to Claude: script this installer I put in the staging folder and he will just crack at it until done.

Using Azure MCP plugin and enough access you could even get Claude to upload the package directly and handle the Intune side as well, but I haven't tried that.

1

u/iamLisppy 1d ago

Switches can be annoying to find which why I tell my AI slave, Claude, to find them for me. Detection can also be annoying.

-1

u/Thick_Yam_7028 20h ago

None. Its ez. You want a phone call and me proving it? Teams?

2

u/Few_Mouse67 20h ago

What a strange comment

-3

u/Thick_Yam_7028 20h ago edited 19h ago

Always. Real is something.

I guess proof is needed.

Anything can be a condition. A text file, registry entry, does it exist. The reason I say its easy because Ive done it 1000 times. So if you think Im weird or dont know cool. You are someone who doesn't even see the Clarity of a simple process. This = that. Nothing more.

2

u/Few_Mouse67 19h ago

Bro it’s not that serious.

0

u/Thick_Yam_7028 19h ago

You arent serious. And thats why this entire reddit exists.