Intune Deployment (Windows)

This guide covers deploying the Pult Agent on Windows devices using Microsoft Intune as a Win32 App, with PSAppDeployToolkit (PSADT) handling the installation and bootstrap token provisioning.

Prerequisites

• Microsoft Intune with Win32 App deployment capability.
• PSAppDeployToolkit (PSADT) v4.1.0 or later.
• The Pult Agent .msi installer file.
• A bootstrap token generated in the Pult Dashboard.
• The IntuneWinAppUtil tool (Microsoft Win32 Content Prep Tool) for packaging.

Step 1: Prepare the PSADT Package

1. Download and extract the PSAppDeployToolkit template.
2. Place the Pult Agent .msi file in the Files/ directory of the PSADT template.
3. Edit the deployment script to:
   • Install the MSI silently.
   • Write the bootstrap token file in the user's %APPDATA% directory (using Start-ADTProcessAsUser to run in user context).
   • Launch the agent in user context after installation.

The key challenge is that Intune runs the deployment in SYSTEM context, but the bootstrap token and app launch must happen in the logged-in user's context. PSADT's Start-ADTProcessAsUser function bridges this gap.

Step 2: Package for Intune

Use the Microsoft Win32 Content Prep Tool to create an .intunewin package:

IntuneWinAppUtil.exe -c <source-folder> -s <setup-file> -o <output-folder>

Step 3: Create the Win32 App in Intune

1. In the Microsoft Intune admin center, go to Apps → Windows → Add → Windows app (Win32).
2. Upload the .intunewin package.
3. Configure the app:
   • Install command: The PSADT install command (e.g., Deploy-Application.exe -DeploymentType "Install")
   • Uninstall command: The PSADT uninstall command
   • Detection rule: Use a custom detection script or file-based detection (check for pult-agent.exe at the expected path and version)
4. Assign the app to the target device or user group.

Step 4: Detection Rule

Use a custom PowerShell detection script to verify the agent is installed:

$AgentPath = "C:\Program Files\Pult Agent\pult-agent.exe"
$RequiredVersion = "0.2.9"

if (-not (Test-Path $AgentPath)) {
    exit 1
}

$Version = (Get-Item $AgentPath).VersionInfo.FileVersion
if ($Version -eq $RequiredVersion) {
    Write-Host "Pult Agent $Version detected"
    exit 0
} else {
    exit 1
}

Step 5: Verify

After deployment:

1. Check the Intune deployment status for the target devices.
2. In the Pult Dashboard, go to Settings → Presence → Device Authentication to review incoming device auth requests.
3. Approve the requests to complete enrollment.

Troubleshooting