AppUpdater

Problem#

Packaging applications for Intune Win32 deployment is repetitive and error-prone: each installer has to be wrapped manually, detection and deploy scripts hand-written, and a way found to keep the app current on devices. There was no reusable tool that could take any installer and produce a hardened, self-updating Intune deployment in minutes.

Background#

Noticed the same packaging headaches recurring internally, and that the business wasn't willing to pay for a licensed tool to solve it. Having already worked through the same underlying pattern once, for the NetDocuments tool, that combination — a proven approach and no appetite to buy a packaged answer — was what pushed generalising it into a tool that could point at any installer.

Implementation#

Built AppUpdater — a PowerShell tool with a dark-theme WebView2 GUI that turns any .exe or .msi into a complete Intune Win32 deployment. It auto-detects installer metadata, generates three upload-ready artifacts (the .intunewin package, detection script, deploy script), and provisions a self-updating agent using a SYSTEM scheduled task with a custom COM DACL (Component Object Model discretionary access control list) granting users trigger-only rights. Optionally deploys its own Cloudflare Worker: a TOTP-protected dashboard, centralised manifest hosting, and per-device telemetry. A full offline mode needs no cloud at all.

Challenges#

Generalising a one-app deployment into a tool that handles arbitrary installers meant auto-detecting silent-install arguments and processes-to-kill from metadata alone. Security was non-negotiable: every downloaded binary is Authenticode-verified, secrets live in Credential Manager or Worker Secrets, and the dashboard uses PBKDF2-SHA256 with rate-limited login and optional TOTP.

Results#

Any installer becomes a secure, self-updating Intune package in minutes with nothing to install beforehand. Productises the NetDocuments deployment pattern into a reusable tool, published source-available under BUSL-1.1.

System structure

How the parts connect

1. Installer + metadata

   An EXE or MSI supplies the application details and packaging input.

2. PowerShell / WebView2

   The tool prepares the package and detection and deployment scripts.

3. Intune → device

   Intune delivers the package; a scheduled task handles device-side updates.

4. Optional Worker

   Manifest hosting and telemetry support the cloud workflow. Offline operation remains available.