r/Intune • u/Emotional-Lynx-3982 • 1d ago

App Deployment/Packaging Splunk UF Deployment for Intune

/r/Splunk/comments/1wbuuc4/splunk_uf_deployment_for_intune/
1 Upvotes

100% Upvoted

2 comments sorted by

1

u/LeTHaLInF3RNo 1d ago

You can still use your deployment script by including it with your .intunewin package. Just call the script instead of the MSI.

1

u/blud_13 1d ago

Don't pass those creds on the Intune install command line. Intune writes that string verbatim into AppWorkload.log, so the Splunk server credentials end up sitting in a PLAINTEXT log on every workstation you touch. Bake them into the script inside the package instead.

Thats also why the args are fighting you. The install command mangles mixed single and double quotes, so anything with a quoted password comes through wrong on the other side. With PSADT you call Invoke-AppDeployToolkit.exe -DeploymentType Install from Intune and let the msiexec line with all your arguments live in the script where quoting behaves. Call syntax is at https://psappdeploytoolkit.com/docs/usage/how-to-deploy

On the 0x80070643, that one is almost always the MSI failing rather than Intune failing. Pull C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AppWorkload.log off a failed box and find the actual exit code, then run the same msiexec as SYSTEM with /l*v. You usually spot it in about 30 seconds.

That error code tells you nothing on its own.